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Office of the Auditor General 

Our Vision 

A relevant, valued and independent audit office serving the public interest 
as the House of Assembly's primary source of assurance on government 
performance. 

Our Mission 

To make a significant contribution to enhanced accountability and 
performance in the provincial public sector. 

Our Priorities 

Conduct and report audits that provide information to the House of Assembly 
to assist it in holding government accountable. 

Focus our audit efforts on areas of higher risk that impact on the lives of 
Nova Scotians. 

Contribute to a better performing public service with practical 
recommendations for significant improvements. 

Encourage continual improvement in financial reporting by government. 

Promote excellence and a professional and supportive workplace at the 
Office of the Auditor General. 



Who We Are and What We Do 



The Auditor General is an independent nonpartisan officer of the 
Legislature, appointed by the House of Assembly for a ten-year term. He 
or she is responsible to the House for providing independent and objective 
assessments of the operations of government, the use of public funds, and 
the integrity of financial reports. The Auditor General helps the House to 
hold the government to account for its use and stewardship of public funds. 

The Auditor General Act establishes the Auditor General's mandate, 
responsibilities and powers. The Act provides his or her Office with a 
modern performance audit mandate to examine entities, processes and 
programs for economy, efficiency and effectiveness and for appropriate use 
of public funds. It also clarifies which entities are subject to audit by the 
Office. 

The Act stipulates that the Auditor General shall provide an opinion on 
government's annual consolidated financial statements; provide an opinion 
on the revenue estimates in the government's annual budget address; and 
report to the House at least annually on the results of the Office's work 
under the Act. 

The Act provides the Office a mandate to audit all parts of the provincial 
public sector, including government departments and all agencies, boards, 
commissions or other bodies responsible to the crown, such as regional 
school boards and district health authorities, as well as funding recipients 
external to the provincial public sector. It provides the Auditor General 
with the authority to require the provision of any documents needed in the 
performance of his or her duties. 

In its work, the Office of the Auditor General is guided by, and complies 
with, the professional standards established by the Canadian Institute of 
Chartered Accountants, otherwise known as generally accepted auditing 
standards. We also seek guidance from other professional bodies and audit- 
related best practices in other jurisdictions. 
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Introduction 



1.1 I am pleased to present my November 2012 Report to the House of Assembly on work 
completed by my Office in the summer and fall of 2012. 

1.2 Since the release of my last report in May 2012, 1 submitted the following reports. 

• My Business Plan for 2012-13, and my Report on Performance for 2011-12 
were provided to the Public Accounts Committee on May 25, 2012 and July 3, 
2012 respectively. 

• My Report on the Province's March 31, 2012 consolidated financial statements, 
dated July 30, 2012, was tabled with the Public Accounts by the Minister of 
Finance on August 2, 2012. 

• My audit opinions on four agencies were dated as follows. 

• Nova Scotia Crop and Livestock Commission - May 25, 2012 

• Nova Scotia Gaming Corporation - June 15, 2012 

• Nova Scotia Legal Aid Commission - May 31, 2012 

• Public Trustee Trust Funds - October 30, 2012 

1.3 I wish to acknowledge the valuable efforts of my staff who deserve the credit for the 
work reported here. As well, I wish to acknowledge the cooperation and courtesy we 
received from staff in departments and agencies during the course of our work. 



Chapter Highlights 



1.4 This report presents the results of audits completed in 2012 at a number of departments 
and agencies. Where appropriate, we make recommendations for improvements to 
government operations, processes and controls. Department or agency responses have 
been included in the appropriate chapter. We will follow up on the implementation 
of our recommendations in two years, with the expectation that significant progress 
will have been made. 
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Message from the Auditor General 



Performance Audits 

Chapter 2 - Education: Home Schooling 

1.5 The Department of Education is failing in its responsibility to protect the education 
rights of children enrolled in the provincial home schooling program. The program 
lacks the key elements necessary to be effective. The audit identified deficiencies 
with the program which significantly diminish the likelihood of the Department 
identifying children who may not be receiving a suitable education. 

1.6 The Department does not have expected learning outcomes for home schooled 
children. Processes to assess the appropriateness of home study programs and 
children's educational progress are inadequate. The Department cannot provide 
effective oversight of home schooled children without clear direction on what the 
children are expected to know and be able to do, and a means to determine whether 
they are meeting those expectations. 

Chapter 3 - Health and Wellness: Capital Health and IWK Health Centre 
Personal Health Information Systems 

1.7 Numerous and significant weakness in IT controls to protect personal health 
information contained in computer systems at Capital Health and the IWK Health 
Centre allow an unnecessarily high risk from internal threats. Neither Capital Health 
nor IWK periodically assess overall IT controls to ensure they are appropriately 
designed and working effectively. 

1.8 Stronger controls are required to protect the privacy of personal health information. 
Controls over authorizing, granting and removing access to computer systems; 
applying security and other software patches; monitoring network activity; and logging 
system user actions require improvement. Both organizations need to improve their 
processes and plans for ensuring continuous operation of computer systems. 

Chapter 4 - Health and Wellness: Hospital System Capital Planning 

1.9 If funding stays at recent levels and available money is allocated as it currently is, 
Nova Scotia's hospital system cannot be adequately maintained and will continue 
to deteriorate. Opportunities for ongoing cost savings are not given adequate 
consideration and the extent to which significant equipment or facilities are used is 
not a significant factor in funding decisions. While preventative maintenance can 
reduce repair costs in the long run, it is not always carried out due to lack of funding. 
A new approach to capital planning for the hospital system is needed which better 
utilizes scarce monetary resources. 

1.10 The Department of Health and Wellness has little information regarding the extent 
to which significant equipment or hospital facilities are used. Utilization data could 
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assist the Department and districts in making both operating and capital planning 
decisions, such as where equipment and services should be located and whether to 
replace existing infrastructure and equipment as it ages. 

Chapter 5 - Trade Centre Limited 

1.11 Overall, the Market Projections Report prepared by Trade Centre Limited in 2010 
to support government investment in the new convention centre lacks appropriate 
analysis and rigor expected for such a significant proposal. We expected a much 
more comprehensive analysis supporting such aggressive growth targets. Important 
industry realities have not been clearly addressed. 

1.12 We also found financial and operational activities examined during our audit were 
not being appropriately managed. Trade Centre Limited does not have an adequate 
internal control framework or sufficiently rigorous financial management practices. 
Processes to approve travel and business expenses are not adequate. Additionally, 
Trade Centre Limited does not have adequate processes in place to ensure the 
procurement of goods and services complies with applicable policies and provides 
value for money. 
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Performance Audits 




Education: Home Schooling 



Summary 



The Department of Education is failing in its responsibility to protect the education 
rights of children enrolled in the provincial home schooling program. The program lacks the 
key elements necessary to be effective. The audit identified deficiencies with the program 
which significantly diminish the likelihood of the Department identifying children who may 
not be receiving a suitable education. If these children are not identified, the Department 
cannot take necessary steps to intervene and provide required support. 

The Department has identified learning expectations and outcomes for the public 
school system. Public school students are periodically assessed to determine if they are 
achieving those outcomes. The Department does not have expected learning outcomes for 
home schooled children and does not require that the children be independently assessed 
to determine if they are making reasonable educational progress. The Department cannot 
provide effective oversight of home schooled children without clear direction on what the 
children are expected to know and be able to do, and a means to determine whether they are 
meeting those expectations. We recommended the Department establish clear and measurable 
expected learning objectives and outcomes and that periodic independent assessment of home 
schooled children be required. 

The Department's processes for assessing the appropriateness of home study 
programs and children's educational progress are inadequate. We found the registration 
form and progress report template are not well-designed to provide guidance to parents, 
study programs are not assessed for adequacy, and the Department does not follow up to 
obtain additional information on incomplete or unclear study programs and progress reports. 
We recommended the Department assess study programs and children's progress against 
established expectations and document the results in its files. 

The Department does not have an adequate system to track whether home schooled 
children are properly registered and progress reports are submitted. We also identified 
significant gaps in the Department's processes to track children transferring between home 
schooling and public school to ensure they are properly registered. 
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Background 



2.1 The Education Act requires all children in the province between the ages of six and 
16 to be registered and attend school. Children may be enrolled in the public school 
system, attend a private school or be registered for home schooling. The Department 
of Education is responsible for the public school system and oversight of children who 
are home schooled. 

2.2 Approximately 950 children were registered for home schooling in 2010-11 and 850 
in 2011-12. Roughly 128,000 students were registered in public schools in 2010-11 
and 126,000 in 2011-12. 

2.3 Two staff are currently responsible for carrying out the Department's oversight and 
administration responsibilities for home schooling. One person reviews and approves 
the home study programs proposed by parents, reviews the children's progress 
reports, and deals with any student-related concerns. The other person is responsible 
for administrative functions such as receiving and processing registration forms and 
reports, and maintaining the files. 

2.4 Parents who wish to home school a child are required to register the child with the 
Department each year. Registration includes providing information such as the 
child's grade level, the last grade level attended in a public or private school, and a 
description of the proposed study program. 

2.5 If a home schooled child returns to the public school system, the school determines 
the appropriate grade placement. Home schooled children are not eligible to receive 
a Nova Scotia high school graduation diploma unless all required high school credits 
have been completed through the public school system or through the Department's 
correspondence study program. 

2.6 The Education Act gives the Minister of Education authority, upon assessment of the 
child, to terminate a home education program if it does not meet the requirements of 
the Act or if the child is not making adequate educational progress. 



Audit Objectives and Scope 



2.7 In the summer of 2012, we completed a performance audit of the Department of 
Education's oversight and administration responsibilities for home schooling. The 
engagement was conducted in accordance with Section 18 and 21 of the Auditor 
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General Act and auditing standards established by the Canadian Institute of Chartered 
Accountants. 

2.8 The purpose of our audit was to determine whether the Department of Education is 
providing adequate oversight of the education provided to home schooled children to 
ensure they receive an appropriate education. 

2.9 The objectives of our audit were to determine whether: 

• the Department has standards and processes for evaluating the adequacy of 
home schooling programs to ensure that each child's right to an appropriate 
education is being protected; and 

• the Department has appropriate processes to monitor the educational progress 
of children enrolled in a home schooling program. 

2.10 Criteria were developed specifically for this engagement. The objectives and 
criteria were discussed with, and accepted as appropriate by, management of the 
Department. 

2.11 Our audit covered the period from July 2010 to September 2012. Our approach 
consisted of interviews with management and staff; documentation of systems and 
processes, policies and procedures; and testing and analysis of files and records. 

2.12 We evaluated the Department's processes for assessing home study programs and 
the children's progress. We did not attempt to assess the educational progress of 
home schooled children or whether the Department's home schooling program is an 
appropriate alternative to public or private schools. 



Significant Audit Observations 



Assessing Home Study Programs and Children's Progress 



Conclusions and summary of observations 

The Department is failing in its oversight responsibilities for the home schooling program. 
The program lacks key elements necessary to be effective. The Department does not have 
written policies or regulations specifying expected learning outcomes for home schooled 
children. Children in the program are not periodically assessed to determine if they 
are making reasonable educational progress. The Department's information materials, 
registration form and progress report template need to be improved to provide clear guidance 
to parents. The Department does not have an adequate process to obtain information on, 
and assess the appropriateness of, home study programs and the children's progress. We 
recommended the Department establish educational objectives and learning outcomes for 
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the program and assess the appropriateness of home study programs and children's progress 
against established requirements. 



2.13 Educational requirements - The Education Act and regulations outline public school 
and home schooling requirements. The Department has identified six essential areas 
of learning for the public school system and learning expectations or outcomes at 
each grade level. Students in the public school system are periodically assessed to 
determine if they are achieving the expected learning outcomes. Through monitoring 
and assessment, schools can identify students that are experiencing difficulties in 
meeting the learning expectations. Schools may then provide assistance to those 
students to help them achieve the expected grade level of education. 

2.14 The Education Act and regulations do not specify what home schooled children 
should know and be able to do (learning outcomes). The Department does not have 
written policies concerning expected learning outcomes for home schooled children. 
The Department also does not require that children enrolled in home schooling be 
independently assessed to determine if they are making reasonable educational 
progress. Without clear and measurable objectives and outcomes, there is a risk that 
the home study programs for some children may not be providing them with a suitable 
education. 

2.15 The Education Act outlines the need for and right of children to develop their potential 
and acquire knowledge and skills. The Department has the responsibility to see that 
the means to accomplish this is provided. The Department has established expected 
learning outcomes for the public school system. These could also be used for the 
home schooling program and revised as necessary, or the Department could create 
new ones specifically for home schooling. The Department cannot effectively assess 
the adequacy of home school programs and ensure home schooled children are 
receiving a suitable education if learning expectations and outcomes are not clearly 
defined, and periodic, independent assessment of the children is not carried out. 

Recommendation 2.1 

The Department of Education should establish clear and measurable learning 
objectives and outcomes for the home schooling program. 

Department of Education Response: 

The Department will move forward with a two-step strategy to respond to identified 
concerns and to develop a rigorous, accountable, and clear framework for home-schooling 
in Nova Scotia . The strategy will comprise short-term actions to address areas that must 
be addressed immediately and longer-term strategic actions to revise the legislative and 
policy framework for students who are home schooled in Nova Scotia. As noted in 2.14, 
current legislation does not identify specific curricula or specific learning outcomes for 
students who are home-schooled. Longer-term strategic actions will be developed over 
the next year which will include reviewing the legislation and regulations which govern 
home-schooling in the province and developing a new legislative and policy framework. 
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The framework will include consideration of appropriate educational standards and 
outcomes for students who are home schooled, and the role of local schools and school 
boards with regard to students who are home-schooled. 

Recommendation 2.2 

The Department of Education should require periodic, independent assessment of 
home schooled children against learning objectives and outcomes. 

Department of Education Response: 

The framework described in 2.1 will include consideration of mechanisms to assess 
educational progress of students who are home schooled. 

2.16 Assessing program plans - The Department's website and information package 
provide material for parents to guide them in developing and implementing home 
schooling programs. The Department told us these materials need to be updated and 
improved. Some of the material uses language and terms that may not be familiar 
to parents. Information should be written in plain language that parents can fully 
understand and consider for their programs. 

2.17 The Department's registration form and progress report template do not provide 
sufficient guidance to parents on how to outline the program plan, which examples 
of the child's work to provide, or the type of information to include with the child's 
progress report. Without sufficient and complete information, the Department cannot 
adequately assess whether a proposed home schooling program is appropriate. 

Recommendation 2.3 

The Department of Education should revise its home schooling material to provide 
clear information and guidance to parents on how to outline the program plan and the 
type of information to provide, including examples of the child's work, in the yearly 
progress report. 

Department of Education Response: 

The framework described in 2.1 will consider the required support for parents in 
developing program plans for their children. 

2.18 Parents have several options when developing a home schooling program. They can 
choose the Nova Scotia public school curriculum through correspondence courses, 
follow one of the many commercial home study programs available, develop their 
own curriculum, or follow a combination of these choices. 

2.19 The Department has not carried out an in-depth assessment of any of the commercial 
home study programs to determine if they are designed to achieve appropriate 
outcomes. Staff indicated they are aware of the content of most of the commercial 
programs that parents are using. 
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2.20 If a proposed study program is developed by the parent, staff told us they review 
the program to determine whether the core areas of learning, such as mathematics, 
writing and reading, are included. From our testing, we found little evidence that staff 
followed up with parents if the information on the study program was not sufficient. 
This is discussed further throughout this chapter. 

2.21 During the time period covered by our audit, one person was responsible for reviewing 
the registration forms and assessing the proposed home schooling programs and 
progress reports. During the two years we audited, between 800 and 950 children 
were registered for home schooling. 

2.22 We selected a sample of 120 children from all areas of the province and at all grade 
levels to determine if the children were properly registered for home schooling and 
whether their study programs were appropriately assessed by the Department. 

2.23 From our examination of the files, we found 102 of the proposed programs did not 
include details on program objectives and what the child was expected to learn. Five 
of the files did not include any information on the study program. Many of the 
program plans were simply a list of the courses and books that would be used by the 
child. It is unclear how the Department could know what the learning objectives are 
for these children based on the information it obtained. 

Recommendation 2.4 

The Department of Education should assess the programs proposed by parents to 
determine if they are designed to achieve appropriate learning objectives and outcomes 
for home schooled children. 

Department of Education Response: 

As materials are developed as described in the preceding sections, submitted plans from 
parents will be assessed with a view to determining the degree of congruence with the 
appropriate educational standards. 

Recommendation 2.5 

The Department of Education should document its assessment of proposed home 
schooling programs in its files, through use of a checklist or other suitable form. 

Department of Education Response: 

The DOE will develop such a list based on the materials developed in 2.1-2.3. 

2.24 Assessing children's progress - The Department's ability to adequately assess home 
schooled children's educational progress is limited because it has not established clear 
and measurable learning objectives and outcomes for those children and many of the 
program plans do not identify objectives and expected learning outcomes. We used 
the files we selected for our sample to determine whether the Department attempted 
to monitor and assess the children's educational progress. 
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2.25 We examined 91 progress reports that were available and found all but one contained 
only the parent's opinion of the child's progress. In most cases, parents provided 
no evidence to support the assessment in the report. Many of the progress reports 
focused on the child's day-to-day activities and what they liked doing, rather than 
what they were supposed to be learning. There were only four instances in which the 
parents submitted examples of the child's work as evidence of progress. 

2.26 The following are examples of the type of information provided. 

• The progress report did not include specific information on what the child had 
learned; it only contained information on what the child liked to learn about. 

• The progress report was written for all three children who were being home 
schooled. The report did not break down each child's progress, or which 
subjects were covered and how each child was assessed. 

• The progress report stated the child was having difficulty reading. The 
Department did not follow up on this report. 

• The registration form indicated the child would be following a program at 
the grade four level but the progress report indicated the child had difficulties 
and instead completed work at the grade two level. This report was received 
during our audit and was referred to staff for follow up. 

2.27 We found no evidence that the Department had concerns with any of the progress 
reports or followed up with the parents to obtain more information on what the child 
had accomplished. 

2.28 If the Department does not adequately review and assess the progress of home schooled 
children, it is unlikely that those who are not making reasonable educational progress 
will be identified and provided support as required. The Education Act recognizes 
the importance to society of educating Nova Scotia's children. The home schooling 
program is poorly designed and lacks necessary information for the Department to 
know whether these children are being suitably educated. It appears that this level of 
oversight would be unacceptable in the public school system and we believe it should 
be unacceptable in the home schooling program as well. The ability of children to 
reach their future potential could be negatively impacted if they are not provided with 
the essential skills that a suitable education can provide. 

Recommendation 2.6 

The Department of Education should obtain information on learning outcomes of home 
schooled children to determine if they are making reasonable educational progress. 

Department of Education Response: 

The DOE will do so based on the materials developed in 2.1-2.3. 
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Recommendation 2. 7 

The Department of Education should document in its files its assessment of the learning 
outcomes of home schooled children. Any action taken as a result of the assessment 
should also be documented. 

Department of Education Response: 

The DOE will do so based on the materials developed in 2.1-2.3. Consideration of the 
most effective mechanisms to fulfill this recommendation will be part of the longer-term 
strategy. 

Registration and Reporting Processes 



Conclusions and summary of observations 

The Department does not have an adequate system to ensure home schooled children are 
properly registered and progress reports are submitted. We recommended the Department 
use its computerized database to track receipt of registration forms and progress reports. 
There are also significant gaps in the Department's processes to track children transferring 
between home schooling and public school to ensure they are properly registered. We 
recommended the Department verify the transfer of children between home schooling and 
public school. 



2.29 Registration process - Parents who choose to home school their children are required 
to register for home schooling with the Department each year. Staff enter registration 
information into a computerized database and file the registration form. From our 
testing of 120 files, we found 116 children had a current registration form on file. The 
registration form for one child was not obtained. For the remaining three files, the 
children ultimately were not enrolled in a home schooling program. We found in 
30 cases, the submission of the registration form was not timely. One registration 
form was submitted a year late. We also found the Department's follow up of late 
registrations was not always timely. 

2.30 Submission of progress reports - Parents are required to submit a report on their 
child's educational progress for the year. The Department uses its computerized 
database to record when a progress report is received. The Department will not 
process a registration form for a child if the previous year's progress report has not 
been submitted. When the Department receives a registration form for the current 
year but no progress report for the previous year, staff put the form aside. The 
Department sends follow-up letters to the parents requesting that the progress report 
be submitted. 

2.31 Manual tracking process - The Department does not have an adequate system to 
ensure that registration forms and progress reports are submitted. Staff use a manual 
process to track whether children registered in the prior year are registered for the 



Report of the Auditor General • • • November 201 2 



Education: Home Schooling 



current year and progress reports are received. Although staff record registration and 
progress report information in the database, the system is not used to generate a list 
of children from the prior year who are not yet registered for the current year or for 
whom progress reports have not been received. Instead, staff review approximately 
900 files to determine if there is a current registration form and set aside those files 
for which one has not been received. Staff also note if a progress report has not been 
submitted. The Department sends follow-up letters to the parents requesting that the 
registration form and progress report be submitted. 

2.32 We believe this process is inefficient and increases the possibility that staff could 
miss a file for which a registration form or progress report was not submitted. The 
Department would not be aware that follow up is needed. The Department has limited 
ability to enforce submission of registration forms and progress reports, relying 
mainly on letters, email and direct contact with the parents. The Department's ability 
may be further limited if the methods it uses to determine when follow up is needed 
are inefficient and unreliable. The Department has a database to record information 
on registration and progress reports which could be used to more effectively track 
whether the necessary forms and reports are received. 

Recommendation 2.8 

The Department of Education should track home school registration using its 
computerized database to determine which children are not registered for the current 
year and whether follow up is needed. 

Department of Education Response: 

Short-term actions will be initiated within the next three to six months, and will include 
developing a system to track key data on home-schooled students such as registrations, 
receipt of progress reports, and transition of students between the public system and 
home-schooling. 

Recommendation 2.9 

The Department of Education should track receipt of progress reports using the 
computerized database to determine which children progress reports have not been 
received and whether follow up is needed. 

Department of Education Response: 

The DOE accepts this recommendation , see 2.8. 

2.33 Transfers between home schooling and public school — There are significant gaps in 
the Department's processes to track children transferring between home schooling 
and public school to ensure they are properly registered for school. 

2.34 When home schooled children are not registered in the following year, the Department 
does not adequately follow up to determine whether these children were enrolled in 
public school or continued with home schooling. Two months after the academic 
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year begins, the Department sends follow-up letters to parents who had previously 
registered their children for home schooling, and then attempts telephone contact 
to find out where the children are attending school. If the Department cannot get 
a response from a parent, the file is marked as inactive and no further contact is 
attempted. If a parent informs home schooling staff that their child will be attending 
public school the following year, staff note this in the file and mark the file as 
inactive. 

2.35 The Department's Statistics and Data Management Division maintains a database 
that contains information on all students registered in the public school system. 
Home schooling staff do not regularly verify with the Division that all children no 
longer registered for home schooling are enrolled in the public school system for the 
following year. 

Recommendation 2.10 

The Department of Education should verify whether children no longer registered for 
home schooling are registered in the public school system. 

Department of Education Response: 

The DOE accepts this recommendation, see 2.8. 

2.36 Schools are not required to notify the Department's home schooling staff if parents 
indicate they are going to home school their child. Schools are also not required 
to follow up with staff to ensure that the child was registered for home schooling. 
The database maintained by the Statistics and Data Management Division captures 
information on public school students whose parents have indicated they are going to 
be home schooled. Home schooling staff do not obtain and use this information to 
track children who are transferring from public school to home schooling to ensure 
they are properly registered. 

2.37 The Statistics and Data Management Division provided a list of 66 students registered 
for public school in 2010-11 who would be home schooled in 2011-12. We determined 
that 20 of the students registered for home schooling, 23 returned to public school, one 
went to private school, one graduated, and two moved from the province. 19 students 
were not registered for either public school or home schooling. These students may 
have left the province or may be 16 years or older and not required to be in school. It 
is also possible some of them are being home schooled but were not registered or are 
not being schooled at all. 

Recommendation 2.11 

The Department of Education should track children leaving public school for home 
schooling to ensure they are properly registered for home schooling. 

Department of Education Response: 

The DOE accepts this recommendation, see 2.8. 
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2.38 The Department does not know when a child moves in or out of the province unless 
the parents inform the Department or the school board. There may be school-aged 
children in the province who are not registered for any type of schooling. The 
Department cannot determine how many such children there may be. The Department 
also does not receive information on children who are registered in private schools 
and cannot track children who leave home schooling for private school. 

2.39 Health records are one way that children of school age may be tracked and accounted 
for. The Department indicated this option is currently not available due to privacy 
issues. The Department also indicated it is in discussions with the Department of 
Health and Wellness to establish an information sharing protocol for certain students 
in another of the Department's programs. If such an avenue were available for home 
schooling, the Department could track all students in the province and determine 
whether they were registered for school. 

Recommendation 2.12 

The Department of Education should explore the possibility of establishing an 
information sharing protocol with the Department of Health and Wellness to enable 
tracking of all school-aged children in the province to determine whether they are 
registered for school. 

Department of Education Response: 

The Department will immediately begin exploratory discussions with the Department of 
Health and Wellness about the possibility of developing an information-sharing protocol 
to enable tracking of all school aged children in the province. 
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Department of Education: Additional Comments 



The Department of Education recognizes it has a responsibility to ensure that all children 
receive a high-quality education, while also respecting the right of parents to make 
decisions about the most appropriate place for their children to obtain this education. To 
fulfill its responsibility in this regard, and in response to the concerns noted by the Auditor 
General with regard to children who are home schooled in Nova Scotia, the Department 
will move forward with a two-step strategy. 
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Numerous and significant weaknesses in IT controls to protect personal health 
information contained in computer systems at Capital Health and IWK Health Centre allow 
an unnecessarily high risk from internal threats. The overall level of control is inadequate 
and must be improved. We identified IT security vulnerabilities as well as deficiencies in the 
management of information technology which also need to be addressed. 

Stronger controls are required to protect the privacy of personal health information. 
Both Capital Health and IWK need to improve controls over authorizing, granting and 
removing access to computer systems; applying security and other software patches; 
monitoring network activity; and logging system user actions. Encryption of sensitive 
data and controlling system changes at Capital Health also need to be addressed. These 
improvements are needed to guard against unauthorized access to health care systems and 
the potential disclosure, modification or deletion of personal health information. 

Control weaknesses unnecessarily increase the risk of inappropriate access and use of 
Capital Health's computer systems and some of IWK's databases by employees and contract 
staff. While external hackers are sometimes the more widely-feared threats to computer 
systems, IT security industry statistics indicate insiders are the predominant threat. In 
addition, since the primary network used by Capital Health and IWK is also shared with 
other district health authorities, the risk of inappropriate access to, and abuse of, information 
by insiders expands beyond the two agencies we audited. 

Both organizations need to improve their processes and plans for ensuring continuous 
operation of computer systems. We recommended better protection of the physical security 
of their information technology as well as improved preparations for recovering from a 
disaster that could put information systems, including those dealing with patient care, out 
of service. 

Deficiencies exist in the management of information technology at both organizations. 
Most of IWK's published policies and procedures are not up-to-date and there is no process to 
keep them current. While Capital Health conducts some risk assessments as part of its project 
management process, it needs to implement a comprehensive, overall IT risk management 
framework to identify, assess and mitigate all significant risks. 

At both Capital Health and IWK, there is no periodic assessment of overall IT controls 
to ensure they are appropriately designed and working effectively. 
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3 Health and Wellness: Capital Health 
and IWK Health Centre Personal 
Health Information Systems 



Background 



3.1 Capital Health is the largest tertiary health care provider in Nova Scotia, operating 
nine hospitals and many other health centres and community-based programs 
throughout Halifax Regional Municipality and the western part of Hants County IWK 
Health Centre (IWK) is a tertiary care facility providing care to women, children 
and families throughout the maritime provinces. These two organizations potentially 
serve all of Nova Scotia. 

3.2 Capital Health and IWK rely heavily on information technology to collect and 
maintain patients' personal information, monitor patients' health, and record medical 
procedures and diagnoses. In our view, based on the potential negative health effect 
that a loss of service could cause, and the hardship and anxiety that patients could be 
subjected to if their personal health information were exposed to people who have 
no need to see it, these two health organizations operate some of the most critical 
information systems in the province. Accordingly, we believe Capital Health and 
IWK information operations and systems need to be subjected to a very high standard 
of control. Our audit was designed to determine if they meet this standard, while 
being cognizant of the organizations' need to not allow IT controls to negatively 
impact patient health. 

3.3 Capital Health's IT Department (eHealth), which consists of approximately 360 staff 
members, supports over 200 unique computer applications and provides support 
services to more than 12,000 employees, physicians and learners and approximately 
1,900 volunteers. Within eHealth, 160 employees are responsible for managing 
Capital Health's local area network, servers and desktops, as well as establishing 
and removing access to the network and most applications. eHealth also provides 
IT services such as project management to various clinical departments, including 
making changes to existing technology or introducing new technology into the 
organization. In some instances, the clinical departments are completely responsible 
for the management of their own applications and only rely on eHealth to host their 
systems. 

3.4 IWK's Technology, Programs and Services Department consists of 62 employees and 
supports 19 clinical applications, as well as health services provided by over 3,200 
employees and 800 volunteers. They are responsible for managing the IWK local 
area network, servers, desktops and access to the network and various applications. 
Clinical departments are not responsible for managing information technology at the 
IWK. 
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3.5 Information technology services at each entity are supported by Health Information 
Technology Systems Nova Scotia, which is an entity mandated by the Department 
of Health and Wellness to provide "a centralized provincial IT infrastructure to 
facilitate the delivery of health care in Nova Scotia ". This includes assisting IWK by 
managing several IT areas, such as service desk activities, email, wide-area network 
access and network security 



Audit Objective and Scope 



3.6 We completed an audit at Capital Health and the IWK Health Centre in the fall of 2012. 
The purpose of our audit was to determine if these organizations adequately protect 
patient health care by minimizing the risk of information security breaches, data 
corruption and downtime due to disruption of IT services. We examined information 
technology infrastructure and processes supporting various systems containing 
personal health information. 

3.7 The specific objective of our audit was to assess the adequacy of controls over the 
development, maintenance and operation of information technology that protects the 
confidentiality, integrity and availability of electronic personal health information. 
In conducting the audit, we used criteria from the IT Governance Institute's Control 
Objectives for Information and related Technology (COBIT 4.1) to assess the IT 
business processes. COBIT is a widely accepted international source of best practices 
for the governance, control, management and audit of IT operations. The exhibit 
below presents the key control areas under the COBIT framework. We addressed 
each of these in our audit, and report our observations in this chapter. 



COBIT Framework 




System Access 

Source: Figure 23, COBIT 4.1 
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3.8 The audit objective and our use of COBIT criteria were discussed with, and accepted 
as appropriate by, members of management responsible for the systems we audited. 

3.9 Audit fieldwork was conducted in accordance with Sections 18 and 21 of the Auditor 
General Act and auditing standards established by the Canadian Institute of Chartered 
Accountants. We conducted our audit between October 2011 and October 2012 on IT 
process transactions that occurred between November 1, 2010 and November 1, 2011. 
Adequacy of IT configuration was assessed at various points in time throughout 
the fieldwork period. We examined supporting operating systems, databases and 
infrastructure for a sample of 10 significant computer systems containing personal 
health information at Capital Health, and five at IWK to support our opinions on the 
organizations' overall management and control of personal health information. 

3.10 We did not examine safeguards to prevent external threats to Capital Health and 
IWK systems through the Nova Scotia Health Network (e.g., firewalls) because they 
are managed by an external entity - Health Information Technology Systems Nova 
Scotia - that was not included in the scope of this audit. 



Significant Audit Observations 



Ensure Continuous Service 



Conclusions and summary observations 

Capital Health and IWK make a copy of all electronic clinical data so that it can be restored 
should it become lost or corrupted. Disaster recovery plans for Capital Health are not based 
on risk or business impact assessments and system prioritization did not consider input 
from user departments. The IWK's disaster recovery plan is outdated, which may affect 
its ability to recover from a disaster in a timely manner. Neither organization has tested its 
disaster recovery plan or provided training to staff on how to implement it during a time of 
crisis. In the event of a disaster that affects the physical integrity of either Capital Health's 
or IWK's data centre and its servers, neither entity has a dedicated secondary site which 
could be used to rebuild systems and restore IT services. 



3.11 Continuous service - All large organizations require formal plans for the maintenance 
and restoration of business functions and the information technology that supports 
them in the event of a disaster. If such plans are not in place, there is a risk that 
services provided by the organization will be unavailable for an excessive length of 
time. 

3.12 Capital Health - There is a process to back up Capital Health's electronic data by 
storing a copy of it on systems located at the Provincial Data Centre. In addition, 
some of Capital Health's data is being recorded on tape and taken to a vendor's site. 
This backed up data can be used to restore Capital Health's systems in the event of 
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data loss. However, the process to restore data is not documented, which may cause 
delays in recovering data in the event key personnel are not available to perform the 
tasks. 

3.13 We are also concerned that the Provincial Data Centre, where the copies of data 
are stored, may be subject to some of the same external risks (e.g., extreme weather 
events, extended power outages) as the primary site due to their close proximity. 
Management informed us that there are plans to review a shared resource approach 
with other hospitals and the province which would result in their data being stored 
at a secondary processing site that is sufficiently separated from their primary data 
centre. 

Recommendation 3.1 

Capital Health should document its data backup and restoration procedures. 



Capital Health Response: 

Capital Health (CH) accepts this recommendation. CH currently has some procedures 
which are well documented. CHwill consolidate all the procedures and review them with 
the regular cycle of policy reviews. 

3.14 Capital Health's disaster recovery plan is reasonably current; it was last updated in 
2010. Our review of the plan identified that no business impact assessment or risk 
assessment was performed to support the plan's priority of systems to be restored. 
The prioritization is based on the assessment of eHealth's management without input 
from the various departments administering and using the IT systems. In addition, 
the plan assigns estimated restoration times for only the most critical systems. 

3.15 There has been no testing of the disaster recovery plan or training for those responsible 
for implementing it in time of a disaster. Capital Health does not have a secondary 
location at which it could recover its IT infrastructure if a disaster causes its data 
centre to be unfit for use. This could be alleviated if management implements the 
shared resources approach noted above. 

Recommendation 3.2 

Capital Health should consult with all relevant departments when prioritizing systems 
for recovery after a disaster. 

Capital Health Response: 

CH acknowledges this recommendation. CH has a Disaster Recovery Plan dated 2010. 
This plan will be reviewed and updated to ensure the current classifications in the plan 
for system recovery are still valid. 

Recommendation 3.3 

Capital Health should provide adequate testing and training for all significant processes 
described in its disaster recovery plan. 
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Capital Health Response: 

CH accepts this recommendation and will formalize its testing and training for significant 
processes. CH currently schedules monthly maintenance on various systems and those 
systems are taken out of service for maintenance and any updates or fixes, and are brought 
up within the time scheduled. All departments have downtime procedures and CH has a 
well coordinated communications plan if the systems will be offline longer than scheduled. 
In addition CH has testing and training experience resulting from a significant downtime 
exercise due to major work on the servers. CH's current approach is cognizant of the 
nature of healthcare and the integration of several systems, specifically the requirement 
to minimize downtime as a result of impact on clinical programs. CH has demonstrated 
in several cases that there is an ability to take the systems down and bring them up and to 
communicate with CH's stakeholders as to the status of any issues. CH will also review 
its business recovery plan more frequently. 

Recommendation 3.4 

Capital Health should have a secondary site at which to restore its systems in the event 
a disaster damages its data centre. 

Capital Health Response: 

CH accepts this recommendation and has been in planning with the provincial government 
over the last year to complete a two phase project: 

1) A provincial health project has redundancy of storage between 2 current data centre 
sites. This is 95% complete. 

2) To, over time, relocate data processing to the Provincial Data Centre. Planning has 
started and some applications have recently been set up at that site. 

3) To work with the province on selection of a secondary recovery site. Due to the 
number of stakeholders (education, justice, healthcare, finance, etc) the provincial 
data centre has the lead. CH is working with them to ensure that CH is included. 
Currently the RFP is being drafted. 

3.16 IWK - All five applications we examined at IWK are backed up regularly. Copies of 
data are sent electronically through a secure channel to the Provincial Data Centre. 
However, the Provincial Data Centre may be subject to some of the same external 
risks (e.g., extreme weather events, extended power outages) as the IWK data centre 
due to their close proximity. 

3.17 IWK has produced a disaster, continuance, and recovery plan, but the plan has not 
been updated since 2003. Management recognizes the need to update the plan. The 
plan indicates that prioritization of systems is based on a risk assessment; however, 
that assessment does not identify the risks or the prioritization criteria for systems. 
A risk assessment and systems prioritization chart was prepared in 2006, but the 
disaster, continuance, and recovery plan was not updated to reflect the new system 
prioritizations. 
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3.18 We also observed that the disaster plan has not been tested and no testing strategy 
exists. In addition, no training has been provided to IT employees on their roles 
and responsibilities and the procedures to follow in the event of a disaster. Like 
Capital Health, IWK does not have a secondary location for its IT infrastructure to 
recover from a disaster that causes its data center to be unfit for use. Management 
has indicated the merged services initiative discussed earlier would provide IWK 
with such a site. 

Recommendation 3.5 

The IWK Health Centre should update its disaster recovery plan. 
IWK Response: 

IWK agrees with this recommendation. The IWK has adopted an All Hazards Approach 
to Emergency Response and has been working with the IWK Emergency Preparedness 
Coordinator to update the plan to accurately reflect the needs of the health centre. It 
is recognized that the IWK and HITS NS is in active planning discussions to move the 
IWK data centre to the Provincial Data Centre in the coming months. Following the 
move, the IWK Disaster Plan will be aligned with the HITS Disaster Recovery plan. It is 
anticipated that the IWK Disaster Recovery Plan will be updated by June 30th, 2013. 

Recommendation 3.6 

The IWK Health Centre should test its disaster recovery plan and ensure IT employees 
have been trained on their roles and responsibilities. 

IWK Response: 

IWK accepts the recommendation of testing the disaster recovery plan. Realistic testing 
of the recovery plan periodically is necessary and can be facilitated through a number of 
procedures, however full interruption test activities are costly, disrupts normal operations 
and within healthcare delivery, will increase patient risk and safety concerns, as critical 
patient care systems would not be available during a full interruption. Disaster planning 
and testing in health care is very complex and problematic. The IWK will develop and 
implement testing procedures through structured walk-through testing, checklist testing, 
simulation testing and table top scenario testing by June 30, 2013. 

Recommendation 3. 7 

The IWK Health Centre should have a secondary site in which to restore its systems if 
a disaster damages its data centre. 

IWK Response: 

The IWK agrees with this recommendation. The RFP for a secondary site is expected to 
be posted later this year by the NS Government. The IWK is aware that the Provincial 
Data Centre can be subject to the same risks, and this has been mitigated by the IWK 
backups that are cloned to the provincial data centre are also cloned again to the CDHA 
data centre. The IWK has three copies of data and also a copy to tape. 
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The IWK will continue with the planning to move the IWK data centre to the provincial 
data centre and utilize the IWK data centre as a backup site while the province moves 
forward with the planning and implementation of a provincial secondary data centre; 
Meditech will be relocated by March 31, 2013 and the other clinical systems will be 
relocated by March 31, 2014. 

Systems Security 



Conclusions and summary of observations 

The latest fixes from IT equipment vendors for security vulnerabilities have not been 
applied to all computer systems at Capital Health or IWK. IWK has not implemented 
network monitoring or network access controls. Capital Health has implemented network 
monitoring and controls, but there are weaknesses in its design and operation. There are 
critical security vulnerabilities because of the configuration and management of IT systems 
within Capital Health. We identified critical vulnerabilities with some databases at IWK 
as well. There are weaknesses in the management of physical security of each entity's data 
centre and related infrastructure. Vulnerability assessments have not been completed at 
either site. 



Network Security 

3.19 The IT network which enables computer systems to exchange data needs to be protected 
by technology that monitors, restricts and reports on data that could potentially be 
harmful, such as a virus or illicit intrusion. 

3.20 Capital Health - Capital Health is monitoring network traffic through an external 
vendor, which provides reports on suspicious behavior. Capital Health has also 
implemented technology to restrict an individual at one of its computers from 
attacking other computers containing personal health information. We identified a 
design and implementation flaw with this protective measure and, as a result, it is not 
providing the level of security intended. 

Recommendation 3.8 

Capital Health should re-evaluate its network controls to restrict harmful traffic 
between systems and mitigate against identified risks. 

Capital Health Response: 

CH acknowledges this Recommendation which relates, in part, to aspects of the provincial 
security umbrella. CH agrees to work to comply with the recommendation to the extent 
possible within its realm of control. CH participates within the provincial health network, 
a single flat network model design, placing all districts within a single managed domain, 
which can introduce a threat to each other's operational status. 
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CH will update its systems/structures by placing computers classed as security threats 
in a quarantined area and additional security services will be implemented to improve 
server network to strengthen security. 

3.21 IWK - The IWK does not monitor network traffic for suspicious behavior and has 
not implemented technology to restrict an individual at one of its computers from 
attacking other computers. 

Recommendation 3.9 

The IWK Health Centre should implement network security measures to monitor and 
restrict malicious network traffic. 

IWK Response: 

IWK agrees with this recommendation and has previously submitted the request to 
purchase a solution, however funding for the solution and the associated human 
resources was not available given competing clinical care resource pressures. The 
IWK does monitor for virus and malware utilizing industry standard products. HITS 
security analysts monitor for malicious activity through nshealth.ca perimeter firewalls. 
Purchasing and implementing a solution requires appropriate funding for both the 
solution and the human resource required to maintain the system. As part of Merged 
Services Nova Scotia (MSNS), HITS will be implementing network access controls over 
the whole nshealth.ca network which will provide the health centre with the ability to 
monitor and restrict malicious network traffic. Target implementation for a network 
access control solution at the IWK would be March 31, 2014. 

System Vulnerability 

3.22 Systems are vulnerable when they do not restrict access to authorized individuals only, 
and when they do not adequately protect confidential information. Vulnerabilities can 
be minimized by: 

• using strong passwords that cannot be guessed; 

• disabling programs with weaknesses; 

• applying fixes to faulty computer code that could allow someone to gain access 
without the use of a password; 

• only allowing people access to information that they require; and 

• ensuring sensitive data is encrypted before being sent to other computers. 

3.23 Capital Health - We examined 10 applications and the 49 computers (servers) and 14 
databases that support those applications. We found critical security vulnerabilities 
that could prevent systems from being available or could allow unauthorized 
individuals to gain access to personal health information. These include: 
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• personal health information, and usernames and passwords which are not 
encrypted when sent between computer systems; 

• failure to change default settings in programs that could be exploited, affecting 
the availability of the application and its data; 

• existence of a blank password, which was associated with an administrator- 
level account permitting full access to personal health information; 

• use of vendor-supplied usernames and passwords; 

• an employee with computer accounts that are no longer required as part of that 
employee's roles and responsibilities within the organization; 

• systems that do not lock out users who try to crack passwords; 

• systems that do not require users to periodically change their passwords 
according to policy; and 

• password settings that permit the use of weak passwords, as well as the actual 
use of very weak passwords. 

3.24 We are particularly concerned about the use of weak passwords. We ran a cracking 
program for 10 minutes on 18 servers. We were able to crack 363 passwords, out of a 
total of 2,605 tested. Two of those accounts had administrator-level privileges, which 
make them more dangerous in the hands of an unauthorized user. Such privileges 
enable the running of powerful computer programs that could damage systems or 
expose data. 

Recommendation 3.10 

Capital Health should better secure its servers and databases by: 

• increasing the strength of acceptable passwords; 

• reviewing for the use of weak or blank passwords; 

• disabling, or at least changing the default passwords, for user accounts no longer 
required; and 

• encrypting all sensitive information that is sent between systems if there is risk that 
it may be viewed in transit by persons not authorized to see it. 

Capital Health Response: 

CH accepts this recommendation and will re-evaluate its password management by doing 
a review of all patient care systems. CH currently balances security risk with the need 
for care providers to have no significant delays in care. CH will improve the consistency 
of password management as it relates to strengthening password protocol and more 
frequent updates of default password. CHdoes have an encryption email service and will 
work with its provincial partners to further improve the security on its email system. CH 
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is currently implementing secure layer on systems as they are approved by vendors. As 
new systems are acquired and upgrades completed CH will provide documented security 
standards for all vendor applications. 

3.25 IWK - We examined five applications and the 12 computers (servers) and seven 
databases that support those applications. We found security vulnerabilities that 
could increase the risk of exploitation or allow unauthorized individuals to gain 
access to personal health information, including the following. 

• Use of a database system that is no longer supported by its vendor. 

• A database containing personal health information that is not protected from 
unauthorized copying. Copies of that database can be read using a widely 
known and available application. 

• Users can bypass an application and directly access a backend database which 
contains personal information. 

• Password settings do not require users to have complex or strong passwords. 

• Settings allow users to reuse old passwords after they have been changed. 

• Settings do not lock out accounts after a number of failed login attempts. 

• There are employees with computer accounts that are no longer required as 
part of their roles and responsibilities within the organization. 

• Improper permissions are assigned on shared folders, one of which contained 
personal health information. 

Recommendation 3.11 

IWK Health Centre should better secure its systems by adding additional controls or 
processes to protect databases including: 

• upgrading or replacing databases that are no longer supported by vendors; 

• ensuring only authorized users can copy or move databases; and 

• restricting end users from directly querying backend databases. 

IWK Response: 

The IWK agrees that the best practice for restricting and securing Microsoft Access 
databases will require existing databases to migrate to a SQL environment. Our current 
practice for development of new databases is to utilize this secure environment. Additional 
human resources will be required to redevelop existing databases. IT will develop policy, 
procedures and a communication plan to prioritize for redevelopment. 

The On Line Service Solution that was implemented in November 2011 is now in Phase 2 of 
development. Phase 2 is configuring the new functionality whereby staff transfer between 
internal departments will have an electronic means to notify and receive approval from 
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managers regarding their removal and additional access to information systems required 
for new roles. 

Recommendation 3.12 

IWK Health Centre should better secure its systems by increasing password and 
account controls which include: 

• requiring users to use complex passwords; 

• preventing users from reusing previous passwords; and 

• locking accounts after a number of failed login attempts. 

IWK Response: 

IWK agrees with this recommendation which will require additional funding. The IWK 
utilizes the provincial standard for passwords; therefore introduction of multiple complex 
passwords for a single care provider introduces risk to patient safety. Physicians 
and clinical care providers are required to access health systems at the point of care 
in emergent situations; therefore, balancing timely access to systems with reasonable, 
intuitive passwords is essential to the safe delivery of patient care. 

The IWK is aware that securing systems is fundamental to protecting confidential 
information. Our aging information systems do not always provide full functionality of 
preventing users from reusing previously used passwords and locking accounts after a 
number of failed login attempts. A review of clinical systems is underway to ensure that 
systems where there is functionality to better control usage of passwords and locking 
accounts is enforced. 

Recommendation 3.13 

IWK Health Centre should better secure its systems by restricting access to shared 
folders to authorized individuals only and reviewing active employee accounts and 
their permissions on a periodic basis to determine if they are still required. 

IWK Response: 

The IWK agrees that reviewing active accounts and their permissions on a periodic basis 
will enhance security and is currently developing policies and procedures to address this 
requirement. This will be implemented by March 31, 2013. 

Patch Management 

3.26 Software sold or freely provided by vendors can have flaws that require fixing. These 
flaws can negatively affect computer system performance and can create security 
vulnerabilities. Individuals with malicious intent research these flaws and attempt to 
use them to hack computers. To help prevent this from occurring, vendors routinely 
provide fixes (patches), or groups of fixes (service packs). Such fixes need to be made 
on a timely basis to reduce the opportunity for someone to use a flaw to hack a 
computer system. 
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3.27 Capital Health - We assessed 49 servers and 14 databases to determine if they were 
updated with the latest vendor fixes. We discovered that 43 of the servers and eight 
of the databases were not up-to-date with their patches or service packs; some were 
years behind. 

Recommendation 3.14 

Capital Health should evaluate, test and install vendor-recommended security patches 
on a timely basis. 

Capital Health Response: 

CH acknowledges this recommendation. Capital Health does install vendor recommended 
security patches when CH can validate that it will not interfere with the clinical 
functionality/performance of the applications or other systems that are connected. CH 
has a complex system of applications, interfaces and back end data centre. CH applies 
patches when they are tested and validated by the vendors and there can be more than one 
vendor involved. If the OS and applications patches are not supported by a vendor CH 
evaluates the risk to patient care, operating system and application team will determine 
the correct source of action. CH makes these decisions after an assessment of the risk. 
CHwill complete an inventory of systems to document patches in place and plans for any 
outstanding updates. 

3.28 While testing the servers and databases, we found that one operating system and seven 
databases were at the end of their life and are no longer supported by their vendors. 
As a result, the vendors are no longer releasing patches to fix security vulnerabilities. 

Recommendation 3.15 

Capital Health should upgrade or replace end-of-life systems to ensure all systems are 
fully supported by their vendors. 

Capital Health Response: 

CH acknowledges this recommendation. CH has some (very few) end of life systems which 
continue to be required from a clinical perspective. CH is working with clinical areas to 
transition to more current systems. 

3.29 IWK - We assessed the six databases and 12 servers supporting our sample of 
applications to determine if they were updated with the latest vendor fixes. We noted 
four were behind in service packs and six were behind in security patches. Were 
not able to assess patches on two operating systems because the reports required 
could not be generated due to vendor restrictions. Four databases were not assessed 
because the IWK did not have access to, or did not support, the database, or patching 
was not applicable to the database technology being utilized. 

Recommendation 3.16 

IWK Health Centre should assess, test and install vendor-recommended security 
patches. 
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IWK Response: 

IWK agrees with this recommendation. Current process is to update servers with the latest 
patches on a monthly basis. The exception to this practice is those vendor health systems 
that prohibit the IT staff to update without vendor approval as clinical information systems 
are complex and therefore require downtime periods whereby clinical care providers will 
not have access to patient information while patches are being tested, installed and then 
tested prior to allowing clinical staff to utilize the system. The IT Department will follow 
up with those vendors where security patches have not been installed for the above stated 
reason, to develop the plan for assessing, testing and installing vendor related security 
patches by December 31, 2012. 

Logging and Monitoring 

3.30 Computer applications, operating systems and databases often have the ability to log 
users' actions; this is referred to as auditing. Systems may keep a record of when a 
person logs into a system or when they view, modify or delete data. These records 
can be viewed to investigate a suspected security violation, or routinely to look for 
unauthorized activity. 

3.31 Capital Health - Of the 10 applications reviewed, only six log user actions. One of 
those six only logs changes to data; the viewing of data is not recorded. None of the 
logs are proactively monitored to determine if system users are accessing information 
that is not required as part of their roles within the organization. No logs were 
maintained for any of the databases we reviewed which support those applications. 

Recommendation 3.17 

Capital Health should enable auditing on all patient-related applications that have the 
ability to do so. 

Capital Health Response: 

CH accepts this recommendation. While some auditing is currently underway, CH 
will be implementing Fair Warning and will implement scheduled auditing based on an 
assessment of risk for patient related applications. 

Recommendation 3.18 

Capital Health should set a requirement that all new patient-related applications 
implemented within the organization have the ability to audit user actions, including 
viewing, modifying and deleting of data. 

Capital Health Response: 

CH accepts this recommendation. When implementing new patient related applications, 
appropriate risk assessment will require consideration of the need for the system for 
specialized and possibly unique services which are of critical importance for patients 
against the risks associated with a vendor's lack of audit ability. 
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Recommendation 3.19 

Capital Health should, on a sample basis, periodically audit patient-related application 
logs to determine if users are accessing information that is not required as part of their 
job responsibilities. 

Capital Health Response: 

CH accepts this recommendation and as indicated is working with its provincial partners 
and is implementing a system called Fair Warning. This system will run random checks 
on the system. It is early implementation stages at CH and CH expects this to be more 
fully functional in 2013. 

3.32 IWK - Of the five applications reviewed at the IWK, three of them log user actions. 
None are being proactively monitored to determine if system users are accessing 
information that is not required as part of their roles within the organization. Logs for 
one application were being reviewed, but this was stopped when it was determined 
that the information in the logs was incomplete. Three supporting databases we 
reviewed do not maintain logs. We noted that system auditing of user actions is now a 
requirement for all new databases developed by the IWK. No support was provided 
to show that this is also required for vendor-supplied applications. 

Recommendation 3.20 

IWK Health Centre should enable auditing on all systems that have the ability to do so. 
IWK Response: 

IWK agrees with this recommendation. Various systems have different risks according to 
the amount of personal health information, sensitivity of the personal health information, 
the number of users of the system and the frequency of use of the systems. Based upon 
these criteria, the IWK has prioritized the Meditech HCIS as the highest priority for 
conducting audits of user activity. The IWK has an audit plan in place and implemented 
proactive audits utilizing a new provincial audit solution in September 2011. Extensive 
work between IWK, HITS and the vendor has been underway to address the technical 
difficulty encountered between the two systems which have extended the go-live date for 
proactive auditing. The IWK has identified that auditing multiple information systems will 
require additional human resources to meet this recommendation. Technical difficulties 
should be resolved by December 31, 2012; with all clinical systems included in a phased 
in approach by 2014 

Recommendation 3.21 

IWK Health Centre should ensure that all new vendor-supplied applications 
implemented within the organization have the ability to audit users' actions, including 
the viewing, modifying and deleting of data. 

IWK Response: 

The IWK agrees with the importance of this recommendation and reports that a process 
has already been established and implemented for more than 1.5 years, whereby all new 
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Request for Proposals (RFP's) require a Privacy Impact Assessment be completed by the 
vendor of choice prior to the signing of a purchase agreement. 

Recommendation 3.22 

IWK Health Centre should, on a sample basis, periodically audit application logs to 
determine if users are accessing information that is not required as part of their job 
responsibilities. 

IWK Response: 

IWK agrees with this recommendation. Audit logs are a record of sequential activities 
maintained by an application or system. Application logs cannot determine if users are 
accessing information inappropriately, but rather the IWK requires a complex auditing 
solution which will identify trends or sequences of events, in concert with additional 
resources to successfully implement periodic and ongoing monitoring within multiple 
health information systems. 

Currently the IWK Privacy Manager is a representative on a Provincial Audit Policy 
Working Group which has a mandate to develop a provincial audit policy applicable 
to all electronic information systems of the Department of Health and Wellness as well 
as the IWK and District Health Authorities that contain personal health information to 
ensure alignment with the provisions of the new Personal Health Information Act (PHIA) 
and its regulations. PHIA is expected to come into effect early 2013. 

Physical Environment 

3.33 Organizations implement safeguards to physically protect their computer systems. 
Risks to the physical security of systems come from both people (e.g., accidents or 
vandalism) and environmental factors (e.g., water, heat or electrical interruption), 
each of which could cause significant damage to IT systems and possibly interrupt 
the organization's core services and operations. 

3.34 Capital Health - We observed a number of good practices at Capital Health which 
help mitigate some of its physical security risks. 

• A security company has been hired to manage access to various hospital sites, 
including the data centre. 

• There is a staff member in the data centre 24 hours a day. 

• Visible identification is to be worn at all times. 

• Access to the data centre is logged. 

• The data centre is equipped with devices that continually monitor and alert staff 
when certain environmental thresholds are met (e.g., temperature, humidity). 

• Network cabling closets are locked. 
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• The data centre has an uninterrupted power supply and backup generator, in 
addition to dual power feeds from the power company. 

3.35 However, we also observed some potential threats and weaknesses in the physical 
security and management of IT infrastructure at Capital Health. 

• There is no approved list of who is authorized to enter the data centre. 

• Visitors are not required to have an escort when they are in the data centre. 

• The hospital's water tanks are located above the data centre, and any significant 
leakage that reaches the data centre could cause damage to IT equipment. 

• IT policies do not address physical security against environmental factors (e.g., 
excessive temperature, water damage). 

• There is no record of the maintenance performed on the data centre air 
conditioners. 

• The physical locks for the data centre have not been changed even though there 
has been a change in who manages these keys and there are problems with 
obtaining keys from staff who have left the organization. 

• No vulnerability assessment has been performed on the physical security of 
Capital Health's data centre and related infrastructure. 

Recommendation 3.23 

Capital Health should strengthen the security over its IT infrastructure by creating 
physical security policies, better controlling access to the data centre, and addressing 
structural issues such as mitigating water hazards and documenting equipment 
maintenance. 

Capital Health Response: 

CH health accepts this recommendation and is updating the Key Control Policy that will 
address obtaining keys from former employees, who is authorized to have a key, etc. The 
data centre locks will be changed. 

The Director of Security has requested CH's security provider to provide key control 
practices they have implemented at other major hospitals. 

The equipment in the mechanical room was located during the original building design 
and relocation is not an option given current physical restrictions. Much and ongoing 
work, including but not limited to work on the AC units; system wide maintenance and 
inspection in each of the last two years and warranty based work, has been completed 
and oversight in this area will be continued. CH is also currently putting efforts on 
relocation to another site and is working with the province on acquiring a secondary 
site. 
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Recommendation 3.24 

Capital Health should have a vulnerability assessment completed on its data centre 
and related infrastructure. 

Capital Health Response: 

CH accepts this recommendation. CH has completed a review in the past and this has 
prompted current activities related to relocation to the new centre and efforts associated 
with finding a secondary site. 

3.36 IWK - We found a number of maintenance procedures and controls at IWK that 
protect the physical security of its systems. 

• The location of the data centre is protected from intrusion by having only one 
access point, which requires a key-card to enter. 

• The data centre is monitored 24 hours a day. 

• Physical security measures are regularly tested to assess their effectiveness. 

• There is environmental monitoring (e.g., temperature, humidity) using sensors 
and software. 

• Visitors are required to be accompanied by an IT staff member at all times. 

• Only one vendor is allowed in the data centre at a time. 

• Employees and vendors are required to wear visible identification badges. 

• Physical security awareness training is provided to new hires. 

• Uninterrupted power supply units are in place, as well as dual underground 
power feeds and two backup generators. 

• Regular maintenance and inspections are performed on equipment by 
authorized personnel. 

3.37 However, we also observed some potential threats and weaknesses in the management 
of the physical security of IT infrastructure at IWK. 

• Management informed us that approvals are required for issuing data centre 
key-cards, but they were unable to provide support that employees currently 
accessing secured areas had received such approval. 

• Data centre key-card access logs are available, but management was not 
reviewing them. 

• Visitor access to the data centre (which does not involve key-cards) is not 
logged. 
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• The emergency procedure for responding to a power disruption is outdated and 
requires modernizing to reflect the current IT environment. 

• No vulnerability assessment has been performed on the physical security of 
IWK's data centre and related infrastructure. 

Recommendation 3.25 

IWK Health Centre should strengthen the security over its IT infrastructure by 
improving controls over physical access to the data centre including: 

• regular review of updated access lists for proper approvals; 

• implementation of logging procedures for all guests; 

• regular review of visitor logs; and, 

• updating emergency procedures. 

IWK Response: 

IWK agrees with this recommendation. A new On-Line Service Request solution was 
implemented in November 2011. This solution requires a request form to be initialized 
by the requester to the appropriate manager requesting a number of services to be 
completed by the IT Department or Protection Services. This system tracks all requests 
and approvals/ rejections for all requests submitted. This new system is utilized for 
requesting key swipe access throughout the health centre, including physical access to the 
data centre. The retention schedule for the approval for all requests is seven years. This 
new system allows for the regular review and updating of access lists to those employees 
who have access to the data centre. 

IT will restrict all physical access to the IT offices effective November 15, 2012. A manual 
log has been reestablished to log all guest access to the server room. 

Recommendation 3.26 

IWK Health Centre should have a vulnerability assessment completed on its data 
centre and related infrastructure. 

IWK Response: 

IWK agrees with this recommendation and recognizes that it is industry standard to have 
a vulnerability assessment completed by an outside agency, however this is a significant 
funding issue. Networks are dynamic, they evolve and change constantly; current 
practices of patch management, system updates, virus and malware monitoring are part 
of securing the network; however an assessment should be set to run constantly to assist 
in informing the administrator of potential threats to the network. Within the last two 
years the IWK requested and received a proposal for an Information Technology Review; 
however funds were not available at the time to move forward with the assessment. The IT 
Department will submit the request for a vulnerability assessment in the 2013/14 Capital 
Equipment funding process. 
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Management of System Access 



Conclusions and summary of observations 

Both Capital Health and IWK systems have existing or past employees with active user 
accounts which are no longer required. Additionally, individuals have been granted access 
to systems based on requests of persons not authorized to grant such access. At Capital 
Health, two applications are managed by a department other than the IT department and 
they do not adequately document granting and terminating of access to those applications. 
We noted that the Capital Health help desk uses the same temporary passwords when 
creating new accounts or resetting passwords, making the accounts more vulnerable to 
unauthorized use. 



Access Management 

3.38 Access management is the process of providing employees with computer accounts, 
setting and changing their ability to access different types of information, and removing 
computer accounts when employees are no longer with the organization. Employees 
only need the level of access that allows them to perform their job. Those with more 
access than necessary have an increased ability to see confidential information or 
perform unauthorized transactions. Employees terminated by an organization could 
retaliate by disclosing, modifying or deleting sensitive information if their user 
accounts are not deactivated at the time of termination. 

3.39 Capital Health - Capital Health employs ticket tracking software to record requests 
for access to the network and some applications. However, not all requests to provide 
or modify access to applications were recorded using this software; notably when 
access to applications was managed by a department other than the IT department. In 
such cases, some requests were only recorded in the email inboxes of the department 
administrators managing the applications. As a result, we could not be sure all access 
changes were recorded and properly managed. In addition, the IT department was 
not always notified when individuals leave the organization and thus needed to have 
systems access removed. 

Recommendation 3.27 

Capital Health should establish a process for every system containing personal health 
information that ensures all requests to grant, modify, and terminate access are 
consistent and traceable. 

Capital Health Response: 

CH accepts this recommendation and will work to ensure consistency across departments 
in terms of granting access, modifying and terminating access. CH will work on 
documenting those procedures for all areas with information technology so management 
across the organization will be applying a consistent framework. 
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3.40 We tested a sample of 60 transactions to grant, change and remove access and found 
the following weaknesses. 

• The help desk ticket only records that access is required for an application, not 
the level of access required. 

• We found two instances in which individuals requested system access for 
another person, but were not authorized to make such a request. In both 
instances, the request was granted. 

• We noted two instances in which the employee's computer accounts were 
not disabled even though they were no longer employees. Management has 
recently implemented a process to confirm that employee's accounts have been 
removed when staff leave. 

• We noted the same temporary passwords were used frequently when accounts 
are created. This enables an individual with knowledge of the frequently used 
password to log into another account if it has not yet been changed by its new 
owner. 

Recommendation 3.28 

Capital Health should use unique temporary passwords when resetting locked-out 
accounts or creating new accounts. 

Capital Health Response: 

CH accepts this recommendation and will review and work to ensure compliance with all 
current password protocols. 

Recommendation 3.29 

Capital Health should ensure that all systems access is only approved by individuals 
authorized to do so. 

Capital Health Response: 

CH accepts this recommendation. CH does have a process to ensure systems access 
is only approved by individuals authorized to do so and will document and ensure all 
departments are applying the same standard. 

3.41 IWK - Upon review and testing of the system access processes at the IWK, we noted 
some good procedures to control access to IWK's network. 

• Forms approved by authorized staff are required. 

• Individuals permitted to submit and approve requests are clearly identified. 

• Temporary passwords are generated and delivered to new users in a secure 
manner and are changed upon initial login. 

• Vendor accounts are only activated when they require access to systems. 
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3.42 We tested a sample of transactions and found the following weaknesses. 

• There is no process to require users (at hire and periodically afterwards) to 
explicitly acknowledge that they received, understand and accept relevant IT 
policies, standards and procedures. 

• Signed confidentiality pledges were provided for 56 of 60 employees tested. A 
periodic refresh of confidentiality pledges is not required. 

• System access forms were not always approved by persons authorized to do 
so. 

• Access was not removed for nine employees no longer employed by the IWK. 

3.43 An online access process was implemented during our audit. Its design includes 
reducing the risk of improper approvals. The effectiveness of this design feature was 
not audited. 

Recommendation 3.30 

IWK Health Centre should ensure that access to all systems is only approved by 
individuals authorized to do so. 

IWK Response: 

IWK agrees with the recommendation. The New On Line Service request solution was 
designed and configured in two phases; Phase 1 was implemented in November 2011 
which provided an electronic method for all requests for purchasing IT equipment, 
requesting access to systems and requesting swipe card access to secure departments 
requiring Manager approval; Phase 2 was the configuration and addition of new forms 
for staff internal transfers; enhancement of the functionality of the system will require 
departing and accepting new managers to remove and add appropriate access to systems 
dependent upon the employees role. This enhancement of functionality is targeted to be 
implemented by March 31, 2013 and will retain the manager's approval for seven years. 

Recommendation 3.31 

IWK Health Centre should enhance its processes to ensure that all users' access is 
removed once their employment has ended. 

IWK Response: 

The IWK agrees with this recommendation. The current process between Human 
Resource Services and the IT Department requires that the IT Department receive 
weekly notification of employees who have resigned or terminated. This IWK practice 
will change from a manual process to an electronic process following the implementation 
of the phase 2 configuration of our new electronic service request solution noted in 
Recommendation 3.30. As part of the quality improvement process, Human Resources 
will review the current workflow notification to incorporate IT notification. There will 
be a monthly review of staff who have resigned or been terminated to ensure access to 
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information systems have been removed. This improvement process will be implemented 
by November 30th, 2012. 

Dormant Accounts 

3.44 Dormant accounts are active computer accounts that have not been used within a 
significant period. An individual with knowledge of the username and password of a 
dormant account could use it to gain unauthorized access to information and perform 
operations that would be difficult to trace back to the individual. 

3.45 Capital Health - We analyzed user accounts for the network, the 10 sample applications, 
and the supporting operating systems and databases we audited at Capital Health. We 
identified a high volume of dormant accounts on the network - 30% of all accounts. 
22% of applications accounts and 7% of database accounts we tested were dormant. 
We could not assess dormant accounts on four applications and six databases because 
the information required to do this could not be generated by the systems. 



Recommendation 3.32 

Capital Health should have a process that ensures all new systems are capable of 
recording when user accounts are set up. 

Capital Health Response: 

CH accepts this recommendation and will ensure a process is implemented that records 
the date of set up. 

Recommendation 3.33 

Capital Health should have a process for the regular review of systems for dormant 
accounts. All unnecessary dormant accounts should be deactivated. 

Capital Health Response: 

CH accepts this recommendation and will update its procedures for account 
management. 

3.46 IWK - We examined user accounts for the network and our audit's five sample 
applications. We identified a high volume of dormant accounts on the network, 
totaling about 25% of all accounts. 

Recommendation 3.34 

IWK Health Centre should have a process for the regular review of systems for dormant 
accounts, and all unnecessary dormant accounts should be deactivated. 

IWK Response: 

The IWK agrees with this recommendation. The IT department will work in consultation 
with the Privacy Office in developing policy and procedures to facilitate regular reviews 
and disabling unnecessary accounts; and will be implemented by March 31st, 2013. 
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Incident and Problem Management 



Conclusions and summary observations 

Capital Health and IWK have weaknesses in their incident and problem management 
processes. Neither entity has documented incident response procedures. Capital Heath 
does not have guidance for service desk staff to prioritize service requests, and does not 
monitor the nature of calls to the service desk and the resources used to resolve them 
in order to ensure the service is properly resourced. There is no problem management 
process at Capital Health or IWK that investigates or documents the underlying causes of 
incidents. 



Incident and Problem Management 

3.47 Incident management is the process of identifying and resolving any IT-related event 
that has a negative effect on the organization's computer systems. This process 
focuses primarily on fixing the issue and not attempting to determine why it occurred. 
Problem management is the process of investigating why such incidents occur and 
attempting to fix the underlying issue that caused the incidents. If these two processes 
are not in place and operating effectively, there could be extended interruption of 
computer services. 

3.48 Capital Health - Service tickets produced at eHealth are prioritized, but there are no 
standards for deciding which types of incidents should be classified as high, medium 
or low priority. While any incident that affects patient care is automatically considered 
high priority, help desk staff are required to assess the situation and assign a priority 
classification based on their own view. If in doubt, staff members are instructed 
to make the ticket a high priority. Without consistent, documented guidelines, an 
improperly assigned priority could affect the resolution time of a real high-priority 
incident. 

Recommendation 3.35 

Capital Health should provide guidance for prioritization of IT service requests. 
Capital Health Response: 

CH accepts this recommendation and is currently partnering with the provincial system 
(HITS NS) to implement a new system called Axios. This upgrade should be underway at 
CHin 2013. Axios is fully ITIL compliant and with this implementation CHwill be updating 
all procedures and the helpdesk will adopt ITIL framework with that implementation. 
CH can make some minor updates in its current system and will do so while ensuring 
appropriate investment is made in implementation of the new system which will the 
functionality will provide a more secure environment with improved auditing, and record 
logs. 
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3.49 There are no documented incident response procedures or a formally organized 
incident response team. In the event a staff member believes something should 
be escalated, it is communicated to the team leaders, who assess the issues and 
communicate with management. For large-scale incidents, management will come 
together with the various divisions of IT (i.e. security, telecommunications) to address 
the issue. 

Recommendation 3.36 

Capital Health should document incident response procedures and ensure its eHealth 
staff members are trained to use them. 

Capital Health Response: 

CH accepts this recommendation and with implementation of the new system will provide 
an improved way to document incidents at the helpdesk. 

3.50 Management monitor the volume of service request calls received on a monthly 
and annual basis, as well as the number of unresolved requests in the queue at any 
particular time. However, little attention is given to the performance of the help desk 
in regards to time taken to resolve problems, appropriateness of solutions applied, 
service desk client feedback, or making comparisons to industry standards. 

3.51 There is no organized problem management process in place at Capital Health to 
address the root causes of incidents reported to the help desk. There have been some 
attempts to implement a process and the help desk software has a problem management 
module, but we were informed that implementation has not been possible due to a 
lack of resources. In addition, when the module was last used, the number of service 
tickets generated crashed the help desk software. 

3.52 eHealth does not generate or monitor metrics on distribution of time among tasks for 
IT staff. These employees can include help desk staff, administrators, programmers 
and project managers. Without such information, management cannot ensure there are 
enough employees to service information technology and the users of the technology. 
This could negatively affect the availability and security of computers and the support 
of computer users. Management has indicated that the recording of employee time is 
being rolled out throughout the organization in the next few years. 

Recommendation 3.37 

Capital Health should monitor the nature of service desk calls and the resources used 
to resolve them to ensure the help desk is functioning effectively and efficiently and 
to ensure significant problems resulting in repeat incidents are being analyzed and 
fixed. 

Capital Health Response: 

CH accepts this recommendation. Please refer to response for recommendation 3.35. 
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3.53 IWK - A service desk application is used at IWK and a log is maintained of all open 
service request tickets. Incidents are to be recorded in the service desk application 
managed by HITS-NS and assigned to technology, programs and services staff at IWK. 
There are no documented incident response procedures to guide staff. Turnaround 
times are established for tickets based on priority, and monthly reports are provided 
regarding timeliness of responses. Incidents are closed after an issue is resolved. 

3.54 Management reviews monthly reports of service desk activity and follows up on issues 
if required. The reports contain metrics for service desk employee performance. 
Although there is no detailed reporting to management, regular meetings occur 
between IWK IT managers and the HITS-NS service desk manager to discuss results 
and address performance issues. 

Recommendation 3.38 

IWK Health Centre should document incident response procedures. 
IWK Response: 

The IWK agrees with the recommendation. Current process for documentation of incident 
responses is through the Provincial Service Desk Express application which is hosted by 
HITS. A procedure document will be developed outlining the documentation criteria 
which will encompass a quality improvement process to review those incident responses 
and ensure there is consistent comprehensive documentation within the service desk 
tickets. This will implemented by December 31, 2012. 

3.55 IWK does not have a comprehensive problem management process. It does not 
identify or document the underlying causes of reported incidents. The organization 
maintains an index of common problems and fixes, but it is not based upon a root 
cause analysis of service desk tickets. 

Recommendation 3.39 

IWK Health Centre should implement a problem management process to document the 
identification, classification, investigation and resolution of IT problems. 

IWK Response: 

The IWK agrees with this recommendation. Our current process for IT related sentinel 
events and/or recurring events is the monthly review at our Information Management/ 
Information Technology Quality Improvement Committee. This process requires 
consultation and collaboration with other stakeholders involved in the incident to identify, 
investigate and resolve through process improvement practices to correct or mitigate 
these occurrences for the future. These process improvements are documented within 
the quality improvement framework and provide feedback to the stakeholders involved. 
As part of the quality improvement framework, adoption of a similar process will be 
implemented for non-sentinel events to facilitate review and root cause analysis, with 
appropriate documentation to ensure there is not an extended interruption of services. 
A new provincial incident and problem management platform is being implemented this 
fall/winter with HITS NS. 



Report of the Auditor General • • • November 201 2 



Health and Wellness: Capital Health and IWK Health Centre Personal Health Information Systems 



Change Management and Project Management 



Conclusions and summary of observations 

Deficiencies in the change management process at Capital Health include the lack of auditing 
in the help desk software to detect and deter unauthorized changes. There is a process to 
manage changes to systems within the IWK, but it is not documented. Project management 
processes are not consistent among Capital Health's various departments, and IT services 
are not always recognized as a stakeholder in IT projects if a project is managed by another 
department. IWK has a project management process that is overseen by project managers, 
but there is no central project listing to track all projects. 



Change Management 

3.56 Adequately secured systems have a rigorous change management process. Such a 
process requires all changes relating to IT infrastructure and applications, including 
emergency maintenance and software patches, to be managed and controlled to 
prevent and detect unauthorized changes. 

3.57 Capital Health - Procedures exist at Capital Health to handle requests for changes 
to applications, operating procedures and processes, system and service parameters, 
and the underlying hardware platforms. The procedures include defining roles 
and responsibilities, classifying and defining priority levels, and guidance for the 
functioning of the organization's Change Advisory Board, which examines and 
approves change requests. 

3.58 We found deficiencies in Capital Health's use of Service Desk Express, the application 
used to manage and monitor changes. Many change tickets produced by the system 
did not have start and end dates, and some tickets were created after the change 
occurred, even though they were not emergency changes. The system is configured 
to permit editing of fields by any user and does not log such editing. The risk is 
that unauthorized system changes could be entered into the system and noted as 
approved. 

Recommendation 3.40 

Capital Health should record proper dates for each ticket produced by the system used 
to track and manage changes. 

Capital Health Response: 

CH accepts this recommendation. Please refer to response for recommendation 3.35. 
Recommendation 3.41 

Capital Health should configure its help desk system so that it blocks unauthorized 
editing of its data. 
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Capital Health Response: 

CH accepts this recommendation and will implement changes at the helpdesk to block 
any editing. Improved functionality for all helpdesk functions will be implemented with 
Axios. 

3.59 Capital Health's change management process is not adequately designed to reduce the 
risk of unauthorized changes occurring. We observed the following deficiencies. 

• For an application managed outside of the e-Health, there is no process to 
detect and inform the change manager of unauthorized changes. 

• Of a sample of 60 change tickets reviewed, 1 1 did not have evidence of approval 
by either the change manager or the Change Advisory Board. 

• There are no policies requiring administrators to always use the application 
to perform data modification instead of circumventing the application and 
posting changes directly to a database. 

• The disciplinary consequence of an employee making an unauthorized change 
is not documented. 

Recommendation 3.42 

Capital Health should implement a process to detect and deter employees from making 
unauthorized changes. 

Capital Health Response: 

Capital Health accepts this recommendation. See response to recommendation 3.35. 

3.60 IWK- Our testing at IWK revealed the presence of some change management controls, 
including change requests and approval requirements. However, these controls are 
not documented. There is no IT Change Advisory Board at the IWK, but Technology, 
Programs and Services relies on representation from various committees to ensure IT 
issues are addressed when implementing new systems or changes. 

Recommendation 3.43 

IWK Health Centre should document its change management process. 
IWK Response: 

IWK agrees with the recommendation. The IT department has a current process in place 
for documenting a change management process that ensures the change request has been 
initiated, the change plans and approval of the change is accepted, all coordination between 
departments, staff notification and training has occurred prior to the implementation of 
the change request. Development of the supporting documentation for these processes 
and procedures that are currently in place will be completed by March 31st, 2013. 

3.61 New systems or large-scale projects at IWK have committees established and a project 
manager assigned. There is a provincial requirement to take new systems or major IT 
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projects to the provincial IT group. All changes require approval by the Department 
of Health and Wellness' Chief Information Office. 

3.62 Large applications have separate test and production environments, which help prevent 
development projects from damaging the Health Centre's live systems. Smaller 
applications do not have their own dedicated test environment. We were informed 
that in such cases, a temporary copy of a production environment is made to perform 
testing of the change prior to moving it to production. 

3.63 Emergency changes, often required when software or a piece of hardware fails, do not 
follow a defined process. They are generally subject to the standard incident response 
process, which was found to be informal and without documented procedures 
(discussed earlier in this chapter). However, the size of the IT department at IWK is 
small enough that management is accessible to approve emergency changes. 

3.64 Technology, Programs and Services is currently enhancing its change management 
process and recently implemented a new procedure for documenting change requests 
and approvals. The new procedure requires completion and approval of an electronic 
request for change form before changes can be made. We concentrated our testing 
on the new process. 

3.65 As a result of our testing, we found one change was implemented before being 
approved. We also identified an instance in which there was no documented evidence 
that testing was completed prior to implementing a change. 

Project Management 

3.66 Best practice in IT project management recommends having specific project controls 
and phases to ensure that what is implemented is in line with agreed-upon expectations 
and outcomes. This requires proper testing, clear implementation roles and procedures, 
and a post-implementation review to help improve future projects. 

3.67 Capital Health - eHealth has a list of active IT projects for which it is responsible, 
but management informed us there are projects run in other departments that have 
an IT component. Sometimes eHealth is not aware of these projects until later in the 
project life cycle. 

3.68 Privacy impact assessments are required for any new application or system that 
contains personal health information. 

3.69 IT project managers at eHealth use a generally accepted project management 
framework. There are specific requirements for project documentation and the 
selection of mandatory project components (e.g., design, testing) are determined on a 
project-by-project basis. 

3.70 We examined two projects. The first was an application upgrade managed through 
eHealth. We found eHealth's project management framework was followed. For 
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example, the vendor provided training, there was a test plan, and a post implementation 
review was performed. 

3.71 The second project was managed at another department. Reasonable project 
management processes were followed, but documentation was less than adequate 
due to much of it being stored in the administrator's email. Without the administrator, 
another individual would not be able to determine which projects were completed and 
whether reasonable processes were followed. 

Recommendation 3.44 

Capital Health should follow eHealth 's project management processes for all significant 
IT projects throughout the organization. 

Capital Health Response: 

CH accepts this recommendation and will work to improve the consistency across 
departments in terms of how projects are managed. CH will work on documenting the 
project management procedures and educating/supporting other departments with their 
Project Manager. 

3.72 IWK - Technology, Programs and Services does not have a central list of all active IT 
projects for which it is responsible. Large projects are assigned project managers and 
steering groups monitor progress. Technology, Programs and Services should have a 
list of ongoing projects with status reports and target milestone dates. 

3.73 All new systems or changes to systems are required to have a privacy impact 
assessment completed prior to implementation. This involves input from an IT 
Security representative and a Risk Management representative. The Risk Management 
department obtains the vendor's privacy policies to assist in preparing the privacy 
impact assessment for the new or upgraded system. Additionally, all requests for 
proposals include a privacy component that must be addressed in the proposal. We 
reviewed five applications and found that privacy impact assessments were prepared 
for each. 

Recommendation 3.45 

IWK Health Centre should maintain a central list of ongoing projects and their 
status. 

IWK Response: 

IWK agrees with the recommendation. Development of a central list of ongoing IT 
projects and their status is currently in development utilizing Microsoft Project. This 
will be implemented and monitored by November 30th, 2012. 
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Management of Data and Operations 



Conclusions and summary of observations 

Capital Health and IWK have policies and procedures to provide guidance in the management 
of data. Both entities acknowledge that their systems will not be able to comply with all of the 
requirements of the new Personal Health Information Act that is expected to be proclaimed 
soon. Capital Health and IWK forecast IT capacity requirements. Capital Health does not 
forecast capacity requirements for the human resources necessary to provide IT services. 



Management of Data 

3.74 Best practices in data management include identifying and classifying an organization's 
data requirements and specifying how each group of data is to be used and secured 
(e.g., identifying and limiting access to highly confidential data). It also includes 
effectively managing data storage media libraries (e.g., data tapes), maintaining 
copies of data off-site in case it is inadvertently destroyed, and securely disposing of 
used data media so that confidential information is not exposed. 

3.75 The province is expected to proclaim a new Personal Health Information Act, which 
will potentially give patients the right to limit or revoke their consent for personal 
health information to be disclosed to other health professionals. Management at both 
Capital Health and IWK told us that existing information systems do not have the 
capability to limit access to information at the detailed level that may be required by 
the new legislation. 

3.76 Capital Health - Capital Health has implemented policies and procedures to identify 
and apply security requirements to the receipt, processing, storage and output of data. 
However, no data classification model has been designed so the level of security can 
be matched with the sensitivity of the various types of data stored. 

3.77 Capital Health has a data storage and retention policy, as well as a process to maintain 
a recorded inventory of stored and archived storage media. This helps ensure the 
usability and integrity of stored information. When the retention period is over, 
Capital Health has a process to securely dispose of sensitive data and software. 

Recommendation 3.46 

Capital Health should implement a data classification policy. 
Capital Health Response: 

CH accepts this recommendation and will develop and implement a data classification 
policy by fiscal 2014. 

3.78 IWK - Data storage and retention arrangements are in place at IWK. As a directive 
from its Privacy Office, the retention period of electronic records is consistent with 
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that of paper records. Secure disposal policies exist and require removal of patient 
information from all storage media before any hardware leaves the hospital site. 
Media containing sensitive data are physically destroyed before disposal. 

Management of Operations 

3.79 Good management of IT operations includes defining operating policies and 
procedures for effective and efficient infrastructure performance (e.g., operating 
servers, monitoring network capacity, running routine computer processes), and 
ensuring the adequacy of hardware preventive maintenance. 

3.80 Capital Health - Not all operational procedures are documented to provide sufficient 
information to ensure that operations staff members are familiar with all the tasks 
and problem solving measures relevant to them. For areas that do have reference 
materials, most of the documents are not dated or are outdated. There is also no 
consistency as to the level of detail and direction provided to staff responsible for 
individual applications. 

3.81 Capital Health uses software that provides automatic notification of hardware faults 
and errors. In addition, an annual preventative maintenance process looks at the life 
cycle of the servers and the warranty remaining. 

Recommendation 3.47 

Capital Health should implement a process to ensure operational procedure documents 
contain sufficient information to guide operations staff in their responsibilities. 
Operational procedure documents should be kept current. 

Capital Health Response: 

CH accepts this recommendation. CH has been working on updating its standards of 
practice documentation and will update all procedure documents by end of fiscal 2014. 

3.82 IWK - In its management of IT operations at IWK, Technology, Programs and 
Services has documents containing information to assist staff members with the tasks 
and problem solving measures relevant to them. These IT operational procedures 
exist in the form of instructions to solve user problems and are available on the IWK 
intranet. IT infrastructure is monitored using software and a dedicated operations 
team. Problems are addressed as they arise. A preventative maintenance plan for 
hardware is in place at IWK. 

Manage Resources 

3.83 Best practices in IT resource management include monitoring the performance and 
capacity of IT resources and forecasting of future needs so that performance and 
capacity issues are detected before they occur. 
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3.84 Capital Health - Capital Health uses software to monitor current capacity and 
performance levels and issues are handled as they arise. However, due to an information 
request from our office, Capital Health managers discovered that a Windows server 
was not being monitored for hard drive space. At the time of discovery, its maximum 
capacity was almost met. This was close to affecting the performance of the server 
and the databases it supported. 

Recommendation 3.48 

Capital Health should ensure all servers are being monitored for hard drive capacity. 
Capital Health Response: 

CH acknowledges this recommendation. CH currently monitors all critical systems for 
their capacity needs. CH forecasts IT capacity requirements for critical patient care 
systems. All new projects include a budget to purchase storage and redundancy to ensure 
capacity will meet demand. Each year CH budgets for added capacity. CH will review, 
within financial capacity, current server planning to evaluate where improvements can 
be made. 

3.85 Human resources capacity management is not performed at Capital Health to ensure 
sufficient staff is available for managing IT infrastructure and providing IT service. 
Management informed us that this is being addressed over the next few years through 
implementation of a case costing application that will require employees to record 
their time. 

Recommendation 3.49 

Capital Health should implement processes to monitor existing human resources levels 
and forecast future capacity requirements for providing IT services. 

Capital Health Response: 

CH accepts this recommendation and will review systems and the alignment of human 
resources currently to ensure that CH has the capacity for future requirements. CH is 
currently undergoing a provincial review process to investigate opportunities for merged 
services. This may have an impact on the human resources and how they are allocated 
and/or managed. CHwill work to implement an improved way of aligning resources and 
projecting future needs. 

3.86 IWK - IWK forecasts IT capacity requirements annually when prioritizing capital 
equipment requests for the organization. Software is utilized to monitor current 
capacity and performance levels, and issues are handled as they arise. The capacity 
and performance of human resources supporting IT is managed by way of a personnel 
time-tracking system and regular meetings between staff and managers. 
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Governance of Information Technology 



Conclusions and summary of observations 

There are deficiencies in the IT governance framework of both entities. Processes in place 
to identify and manage risks relevant to health IT systems at Capital Health are inadequate. 
At IWK, there is no overall assessment of IT controls and IT policies are not maintained. 
Capital Health does not centrally document identified risks, and its focus on risk mitigation 
is at the project level, rather than at an organizational level. IWK maintains a record of 
identified risks and the action plans prepared to mitigate those risks, but does not identify 
residual risk in its risk register. 



IT Governance 

3.87 In a well-run organization, information technology fully supports the organization's 
vision, mission and strategic goals. To ensure this occurs, management governs 
how IT is implemented and used. This includes ensuring IT strategies align with 
organizational strategies, having rules to govern how technology is to be used and 
controlled, monitoring the performance of technology and the human resources 
supporting it, and identifying and mitigating technological risks. 

3.88 Capital Health - We observed alignment between Capital Health's strategic goals 
and the strategic plans of its IT division (eHealth). IT projects link directly to the 
accomplishment of the organization's goals. The five strategic streams outlined in the 
organization's business plan are integrated into the employee performance appraisal 
process. This ensures that employees align their priorities with Capital Health's 
objectives. The business plan also includes an information management strategy 
outlining related priorities and initiatives for IT at Capital Health. 

3.89 IWK - Members of Technology, Programs and Services participate in organization- 
wide, cross-functional committees to obtain funding, monitor achievement of 
objectives and manage risk. A process is in place to update the Division's stakeholders 
annually on its activity. 

3.90 Technology, Programs and Services takes direction from the IWK Strategic Plan 
and provincial directives. Requests for new technology are submitted for funding 
approval on an annual basis and are assessed, prioritized, and approved based on the 
IWK's business strategy and the provincial IT strategy. 

Policies and Procedures 

3.91 Due to the sensitive nature of much of the information health organizations maintain, 
employees need to know what they can do with computer resources and the personal 
health information contained within them. The documentation and communication 
of up-to-date policies and procedures is imperative to protecting such information. 
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Without such measures, there is greater risk of unauthorized exposure of confidential 
information. 

3.92 Capital Health - Executives at Capital Health communicate and reinforce the 
organization's control culture, ethics and values to staff through policies. There is 
also a policy requiring regular review and updating of policies. We found that Capital 
Health was in the process of updating their policies and subsequently published those 
policies during our audit. 

3.93 At Capital Health, the process to provide users with access to the network includes 
both a documented acknowledgement by users of policies reflecting confidentiality, 
and the submission of the results of a criminal record check. After hire, however, an 
employee is not required to acknowledge new or changed IT policies. 

Recommendation 3.50 

Capital Health should require employees to periodically refresh their acknowledgement 
of confidentiality policies, especially when there are significant changes. 

Capital Health Response: 

CH accepts this recommendation and will be using CH's online learning system (LMS) 
to implement a mandatory annual review for all employees. This system will track 
completion of the session by employee. 

3.94 Capital Health has a policy that requires employees to follow specific procedures 
upon identification of a policy breach or when an exception to policy is necessary. 
Required communication includes notifying the Policy Office, as well as identifying 
related risks and mitigation strategies. The policy also identifies who can approve 
such exceptions. However, the policy does not define the types of exceptions it is 
meant to address; therefore, it could be interpreted to include clinical, information 
technology and other policy exceptions. 

3.95 Through our IT configuration testing, we found a policy breach that did not follow the 
protocols. While performing routine monitoring, management discovered changes 
to a system's password settings that did not comply with Capital Health's password 
policies. No risk assessment was completed and the individual who approved the 
changes did not have appropriate authorization. 

Recommendation 3.51 

Capital Health should ensure the requirements of its policy exception policy are being met. 
Capital Health Response: 

CH acknowledges this recommendation. The intention of the Policy Exception Policy was 
primarily for direct clinical care cases. In the administration/support areas, exceptions 
may be approved by the Manager/Director. CH will ensure clarity of its policies on this 
topic. 
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3.96 IWK - IWK does not have a current set of policies covering all areas of IT. This 
includes the important area of IT security. The organization is in the process of 
updating all of its policies, but there is no process to update policies on an ongoing 
basis. 

Recommendation 3.52 

IWK Health Centre should develop a current, comprehensive set of policies to guide its 
use and control of information technology. 

IWK Response: 

IWK agrees with the recommendation. The IWK will work in concert with other DHA's 
and HITS-NS to develop comprehensive IT policies. As we move along with Merged 
Services Nova Scotia, these polices will be developed at the provincial level and will be 
incorporated within the Provincial OP3 Initiative (One Province - One Process - One 
Policy). In light of new legislative changes and the provincial joint initiative in policy 
development, IWK is working along with other provincial DHA 's in the development and 
revision of privacy policies. This is also in alignment with the Shared Services model. 

Recommendation 3.53 

IWK Health Centre should develop a process to keep its policies up-to-date. 
IWK Response: 

IWK agrees with the recommendation. The IT Department has several policies that 
have been updated; however they are currently in draft format. A formal mechanism for 
reviewing, updating and submission for approval will be developed and implemented for 
current policies by March 31, 2013. 

3.97 The IWK has human resource procedures that communicate privacy and 
confidentiality policies to system users prior to users gaining access to confidential 
information. However, documented acknowledgement of such policies by system 
users is not required. 

Recommendation 3.54 

IWK Health Centre should require employees to provide documented acknowledgement 
of their understanding of confidentiality and IT security policies at the time of hire and 
periodically during their employment term. 

IWK Response: 

IWK agrees with the recommendation. The IWK is compliant with this recommendation 
for all new hires; this practice has been in place for many years. The IWK will require all 
users at hire and regularly thereafter to read and sign the revised confidentiality pledge 
form. 

The IWK Privacy Manager is currently a member of a provincial working group, along 
with privacy representatives from all nine DHAs, that is developing a Privacy E-learning 
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module. ThelWKplans to implement the E-Leaning module in early 2013, as a requirement 
for all current and new employees upon hire and annually thereafter. Employees will be 
required to refresh and re-sign their confidentiality pledge annually, upon completion of 
the Privacy E-Learning module. 

Monitoring of IT Controls 

3.98 To ensure business processes designed to protect confidential information are working 
as intended, an organization needs to assess processes on a periodic basis. Significant 
weakness need to be fixed promptly. 

3.99 Capital Health - There is no internal audit group at Capital Health to assess IT 
controls and there have not been any external reviews to provide assurance on the 
organization's overall IT control framework. 

Recommendation 3.55 

Capital Health's IT control framework should include a process for monitoring and 
assessing IT controls. 

Capital Health Response: 

CH accepts this recommendation and will work on reviewing and updating its IT control 
framework. 

3.100 IWK - There is no internal audit group at IWK to assess IT controls and we did not 
see evidence of any external reviews of overall IT controls. Various committees and 
processes exist within the organization that act as a mechanism to detect and track 
control deficiencies. The identification of risks based on the annual enterprise risk 
management process may also identify gaps in internal controls, but the exercise does 
not provide assurance that controls are designed properly and operating effectively. 

Recommendation 3.56 

IWK Health Centre's IT control framework should include a process for monitoring 
and assessing IT controls. 

IWK Response: 

The IWK agrees with the recommendation. Through Service Level Agreements (SLA) 
with our clients, we establish clear ownership and responsibilities for IT control, support 
and general acceptability of system and processes. There is a need to improve current 
processes and to provide better alignment based upon a clinical focus; and improve upon 
our shared understanding amongst all stake holders. Adoption of SLA is built into the 
implementation of all new systems over the past 12 months. Development of a process to 
review and develop SLA's for existing systems is currently underway and acknowledge 
this will require additional resources and time to coordinate with all of the stakeholders 
involved with clinical systems. As we move forward with Merged Services Nova Scotia 
the IT control framework will be identified and implemented with a provincial lens rather 
than an individual DHA/IWK. 



Report of the Auditor General • • • November 201 2 



Health and Wellness: Capital Health and IWK Health Centre Personal Health Information Systems 



Risk Management 

3.101 Risks include any events that would adversely affect an organization's operations. 
Best practices in risk management include having a process that documents identified 
IT risks, related mitigation strategies and leftover residual risks. Analysis and 
assessment of IT risks should align with the organization's overall risk identification 
processes. Adoption of risk mitigation strategies should minimize residual risk to an 
accepted level. Failure to assess and mitigate IT risk within health organizations can 
result in events that affect the confidentiality, integrity and availability of personal 
health information. 

3.102 Capital Health - Capital Health does not have an IT risk framework. The eHealth 
department manages risk on a project-by-project basis; however, this only addresses 
the specific risks of implementing new technology or changes to existing technology. 
eHealth does not perform a periodic assessment to document IT-related risks that 
could affect the entire organization. There is no central registry to document risks 
identified through other means, nor has a risk tolerance level for the organization 
been defined. There are no action plans developed to mitigate known risks. 

Recommendation 3.57 

Capital Health should implement an IT risk assessment framework that includes 
determining and documenting IT risks, related mitigation strategies and the 
acceptability of its residual risks. 

Capital Health Response: 

CH accepts this recommendation and will work on reviewing and updating the IT risk 
assessment framework. 

3.103 IWK - Technology, Programs and Services has an IT risk management framework 
that includes an annual process to identify and update risks in a document referred to 
as a risk register. A dedicated staff member works closely with the Health Centre's 
Risk Management Office to ensure IT risks are managed in concert with overall 
organizational risks. The Risk Management Office defines the context for applying the 
risk assessment framework during the annual enterprise risk management process. 

3.104 We observed that assessments of threats in the risk register were performed in a 
consistent manner and linked to documented mitigation strategies and action plans. 
However, the risk management process does not document the levels and acceptance 
of the residual risks remaining after mitigation strategies have been implemented. 
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Recommendation 3.58 

IWK Health Centre should include residual risks as part of the maintenance of its risk 
register. 

IWK Response: 

IWK accepts the recommendation and will enhance our current risk register to document 
the residual risk following the implementation of the identified resolution or mitigation 
strategy. This enhancement will be implemented through our regular review process. 
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Summary 



If funding stays at recent levels and available money is allocated as it currently is, Nova 
Scotia's hospital system cannot be adequately maintained and will continue to deteriorate. 
Currently, significant deficiencies often continue due to lack of funding. Opportunities for 
ongoing cost savings are not given adequate consideration and the extent to which significant 
equipment or facilities are used is not a significant factor in funding decisions. A new 
approach to capital planning for the hospital system is needed which better utilizes scarce 
monetary resources. 

Only a small portion of infrastructure and equipment requests are funded each year. 
The Department of Health and Wellness estimates more than $600 million will be needed in 
the next ten years for the most basic infrastructure needs in order to maintain the system as 
it now exists. While preventative maintenance can reduce repair costs in the long run, it is 
not always carried out. This is often due to lack of funding. Many of the funding requests 
each year relate to aging equipment; only a portion of these requests are funded in any given 
year. 

Despite the challenging financial situation facing the hospital system, Health and 
Wellness is not fully exploring areas which could generate operational cost savings. Capital 
projects which would result in a net reduction in costs do not get appropriate consideration 
because they cannot be covered through available annual funding and district health 
authorities can only incur debt under the Health Authorities Act with Governor-in-Council 
approval. Improvements to infrastructure may also be possible through energy performance 
contracts with private sector companies. These contracts do not require up-front investment 
by the public sector entity and can lead to long-term operational cost savings by improving 
energy efficiency. Initially these cost savings are used to cover the contracted upgrades; 
once the contract has been paid, the entity realizes ongoing cost savings. We recommended 
the Department examine the risks and rewards of energy savings contracts. 

The Department of Health and Wellness has little information regarding the extent 
to which significant equipment or hospital facilities are used. In times of limited funding, 
utilization data could assist the Department and districts in making both operating and capital 
planning decisions, such as where equipment and services should be located and whether to 
replace existing infrastructure and equipment as it ages. We recommended the Department 
begin to collect utilization data and consider it in capital planning decisions. 

Substantive changes are needed to the Department of Health and Wellness' capital 
planning processes to make better use of available funding and take advantage of opportunities 
for operational cost savings. Given the province's fiscal situation, the solution is not simply 
more funding. Implementing the recommendations in this chapter will represent a significant 
step towards improved capital planning for hospitals. 
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Background 



4.1 Hospitals in Nova Scotia are administered by nine district health authorities and the 
IWK Health Centre. For purposes of this report, the phrase district health authorities 
includes the IWK. 

4.2 The district health authorities are established and governed by the Health Authorities 
Act. They operate 42 hospitals across the province (see exhibit below), and are 
responsible for providing care to all Nova Scotians. The Department of Health 
and Wellness is responsible for most of the funding, as well as overall direction and 
oversight of the hospital system. 
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4.3 District health authorities request capital funding from the Department of Health and 
Wellness through the annual business planning process. Capital funding is provided 
through a variety of funding envelopes, primarily infrastructure (divided between 
small and large projects) and medical equipment. District health authorities cannot 
borrow to finance capital projects because the Health Authorities Act does not allow 
authorities to incur debt without Governor-in- Council approval. 

4.4 In addition to provincial funding, district health authorities generally receive funding 
from local hospital foundations and auxiliaries. Provincial funding often covers 75% 
of expected project costs with the remaining 25% to be provided by the local area 
for all projects except smaller infrastructure repair and renewal work. Foundations 
and auxiliaries assist district health authorities with funding projects which receive 
provincial funds as well as other projects. Districts work with their foundations and 
auxiliaries to determine where this additional funding is spent. 

4.5 Each year, district health authorities only receive funding for a small percentage of 
their total capital requirements. Nova Scotia is not the only province to face this 
problem. Lack of sufficient funding to maintain the hospital system's capital stock is 
a common theme across many jurisdictions. 

4.6 The cost of healthcare is expected to face a continual rise, with constant pressure 
on budgets resulting in an ongoing need to carefully manage spending. District 
health authorities are responsible for all maintenance of existing infrastructure and 
equipment. Traditionally, this is an area in which budget cuts have a significant 
impact. Deferred maintenance is a common theme across many jurisdictions, despite 
the understanding that failing to maintain capital stock will have significant negative 
impacts in the long term. 



Audit Objectives and Scope 



4.7 In September 2012, we completed a performance audit of capital planning and asset 
management activities in the hospital system. We chose to focus our work on hospital 
infrastructure and medical equipment. We audited the Department of Health and 
Wellness, and three health authorities - Capital Health, South Shore Health, and 
Guysborough Antigonish Strait Health Authority. We wanted to determine whether 
capital planning is adequate to maintain the hospital system's capital stock and 
address the greatest needs on a provincial basis. We also wanted to assess whether 
the level of asset maintenance is sufficient to ensure hospital capital stock does not 
deteriorate. 

4.8 The audit was conducted in accordance with Sections 18 and 21 of the Auditor 
General Act and auditing standards established by the Canadian Institute of Chartered 
Accountants. 
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4.9 The objectives of the audit were to assess whether: 

• capital planning systems and processes are adequate to appropriately allocate 
capital resources within and among district health authorities; 

• capital planning processes are adequate to maintain the hospital system's 
capital stock; 

• health authority records adequately track the age, condition and maintenance 
of assets; and 

• health authority asset maintenance processes are adequate to ensure patient 
safety and operational objectives are met. 

4.10 Certain audit criteria for this engagement were adapted from Accreditation Canada's 
Qmentum Standards; most were developed by our Office. The audit objectives and 
criteria were discussed with, and accepted as appropriate by, senior management at 
Capital Health, South Shore Health, Guysborough Antigonish Strait Health Authority, 
and the Department of Health and Wellness. 

4.11 Our audit approach included examination of policies, documents and reports, 
interviews with staff and management, and testing compliance with policies and 
processes. The audit period covered April 2010 to March 2012. 



Significant Audit Observations 



4.12 This chapter refers to long-term capital planning. As in any organization, district 
health authorities and the Department of Health and Wellness must consider strategic 
planning for the future; this includes long-range planning for capital requirements. 
While we acknowledge that government prepares budgets on an annual basis, we 
believe long-term capital planning is still needed. This should include multi-year 
plans outlining the projects expected to be addressed in each year. Plans would 
be revisited annually as the Department and district health authorities consider how 
capital assets will be replaced, and would address possible alternatives if available 
funding cannot cover all projects intended for the current year. 

Capital Planning by the Department 



Conclusions and summary of observations 

If funding is maintained at recent levels, the province cannot continue to cover equipment 
and infrastructure repair and replacement needs. The funding estimated for basic 
infrastructure repair and renewal over the coming decade will cost far more than traditional 
funding amounts can cover. These estimates do not include the cost of all infrastructure or 
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medical equipment, or costs for any new facilities. There is no province-wide, long-term 
capital planning for the hospital system. Consistent with that approach, funding is provided 
on an annual basis and levels have fluctuated over the past five years. The Department is 
not fully exploring areas which could generate operational cost savings, such as energy 
performance contracts and projects which would reduce annual operating costs. In 
addition, there is no tracking of the extent to which equipment and buildings are used. This 
information could be useful in making capital spending decisions. We recommended the 
Department implement multi-year capital planning. We also recommended the Department 
consider system-wide utilization patterns for facilities and significant equipment. 



4.13 Overall process - The Health Authorities Act requires all district health authorities to 
submit an annual business plan to the Department of Health and Wellness, including 
capital expenditure priorities for the following fiscal year. For the 2012-13 budget year, 
the Department asked districts to submit their top-ten capital equipment requests and 
all infrastructure requests separate from their business plan since capital projects go 
through a separate approval process. 

4.14 The Department of Health and Wellness' funding for capital projects is determined by 
Treasury Board as part of the provincial budget process. District health authorities 
may receive additional funding from their foundations and auxilliaries. Traditionally, 
Health and Wellness has required each district health authority to cover 25% of the cost 
of approved projects; these funds often come from local sources such as foundations, 
auxilliaries, or other fundraising efforts. 

4.15 The Department's approval processes for equipment and infrastructure requests 
vary depending on the type and dollar value of the project. These are discussed in 
greater detail later in this chapter. The Infrastructure and Equipment Stewardship 
Committee provides oversight for all hospital system capital matters. All capital 
projects greater than $1 million require Order-in- Council approval, regardless of the 
nature of the request. 

4.16 No long-term planning - The Department of Health and Wellness does not have long- 
term capital plans for the hospital system. All funding is completed on a year-by-year 
basis. In many cases, the Department requires projects to be completed within the 
current budget year or the project may not be funded. 

4.17 In addition to the challenges of trying to plan capital projects under a single -year 
funding approach, capital funding has also varied from year to year. The 2011-12 
provincial budget did not include any capital funding for the hospital system. During 
the year, a small number of elevator and fire safety projects were completed and other 
projects were funded through emergency funding. Fluctuations and situations in 
which there is very little funding available cause further challenges for the district 
health authorities as they try to plan for the future. 
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4.18 The exhibit below shows capital funding over the past five years and illustrates the 
variation from year to year. 



Department of Health and Wellness Capital Funding 
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$29,132,520 
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Excludes funding for the new Colchester Regional Hospital 
Source: Department of Health and Wellness 



4.19 We recognize that under the province's budget system, Health and Wellness does not 
ultimately control the amount of funding it receives each year. While this can lead to 
challenges in developing multi-year capital plans, we noted that Transportation and 
Infrastructure Renewal has five-year plans for the highway system. While we did 
not audit those plans, we highlight this as an example where longer-term plans are 
currently used in government. 



Recommendation 4.1 

The Department of Health and Wellness should implement multi-year capital planning 
for the hospital system. 



Department of Health and Wellness Response: 

DHW agrees with this recommendation and the need for multi-year capital planning. 
DHWhas begun to develop processes for the implementation of multi-year plans and will 
continue to explore options for the completion of a provincial plan for clinical services 
which is a key component of multi-year capital planning. A multi-year capital planning 
process will be in place by Mar 31, 2014. 

4.20 Asset utilization - Health and Wellness does not track facility or medical equipment 
utilization patterns throughout the province. The Department does have some basic 
utilization data on the services available at each hospital but this is not used in any 
meaningful way to assess the needs of the province's hospital system. Beyond 
anecdotal information on large equipment items, Health and Wellness does not have 
adequate, up-to-date information regarding where equipment is located or how it is 
utilized throughout the province. 

4.21 Utilization data can assist with decision-making by providing information regarding 
which facilities or pieces of equipment are not being used near their capacity. In 
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times of limited funding, this could assist the Department and districts in making 
both operating and capital planning decisions, such as where equipment and services 
should be located and whether to replace existing infrastructure and equipment as it 
ages. There are many difficult decisions to be made regarding the hospital system. 
Funding allocations must consider system-wide needs; utilization data can be key to 
ensuring decisions are based on the best available information. 

Recommendation 4.2 

The Department of Health and Wellness should collect utilization data for major 
medical equipment and hospital infrastructure. 

Department of Health and Wellness Response: 

DHW agrees with this recommendation and the need to have utilization data for major 
medical equipment and hospital infrastructure. DHW will strengthen current processes 
to compile utilization data for major medical equipment and hospital infrastructure. The 
process will be in place and information collected by Mar 31, 2014. 

Recommendation 4.3 

The Department of Health and Wellness should consider utilization data when making 
funding allocation decisions. 

Department of Health and Wellness Response: 

DHW agrees with this recommendation and the need for greater consideration of utilization 
data when making funding allocation decisions. DHW will review and revise decision- 
making processes to incorporate utilization data. Although important, utilization data 
is one of many criteria used in DHW decision-making processes. DHW will continue to 
explore options for the completion of a provincial plan for clinical services which is a key 
component of the process to consider utilization data when making funding allocation 
decisions. The revised process will be in place by Sept 30, 2014. 

4.22 Annual capital planning at the Department - Equipment and infrastructure funding 
requests are reviewed by various committees or groups at the Department of Health 
and Wellness. 

• Infrastructure Repair and Renewal Committee: capital repair and renewal 
project requests under $90,000 

• Infrastructure Management Repair and Renewal Committee: projects between 
$90,000 and $1 million 

• Equipment group: all equipment requests 

4.23 These committees and groups make recommendations to the Department's 
Infrastructure and Equipment Committee which provides oversight of hospital system 
capital funding decisions. The Infrastructure and Equipment Committee determines 
which projects are funded each year, subject to final approval by the deputy minister. 
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4.24 Infrastructure Repair and Renewal Committee - The Infrastructure Repair and 
Renewal Committee includes five members of Health and Wellness' infrastructure 
group and one representative from each district health authority. The Committee 
develops funding criteria to assess projects. Each district health authority submits 
its list of priority projects with supporting explanations to the Committee. The 
Committee discusses each project and assigns a score; these scores determine the 
province-wide priorities. 

4.25 This collaborative approach which includes district health authorities and the 
Department helps ensure a better understanding of funding decisions while still 
retaining overall funding authority at Health and Wellness through the Infrastructure 
and Equipment Committee and deputy minister. 

4.26 Infrastructure Management Repair and Renewal Committee - The Infrastructure 
Management Repair and Renewal Committee is comprised of five members of the 
infrastructure group at Health and Wellness. While the scoring criteria used are 
shared with district health authorities, the districts play no role in developing the 
criteria or assessing funding requests. The Committee reviews and ranks each 
submission, creating a province-wide priority list for projects between $90,000 and 
$1 million. We understand district health authority involvement in the Infrastructure 
Repair and Renewal Committee has been a positive step. By not involving districts 
in the Infrastructure Management Repair and Renewal Committee, the Department 
is missing an opportunity to create better buy-in and understanding of the funding 
allocation process. 

Recommendation 4.4 

The Department of Health and Wellness should include representation from all district 
health authorities and the IWK Health Centre on the Infrastructure Management 
Repair and Renewal Committee. 

Department of Health and Wellness Response: 

DHW agrees with this recommendation and the need for representation from all District 
Health Authorities and the IWK Health Centre. DHW will include representation from all 
District Health Authorities and the IWK Health Centre on the Infrastructure Management 
Repairs and Renewal Committee for Apr I, 2013. 

4.27 Equipment - The equipment group is comprised of staff from the Acute and Tertiary 
Care Branch at Health and Wellness, along with a representative from physician 
services. This group is responsible for assessing equipment requests and making 
funding recommendations. 

4.28 We are concerned there is insufficient focus on equipment by the Department. The 
acute and tertiary care staff responsible for reviewing equipment funding submissions 
have significant additional responsibilities; equipment funding represents a small part 
of their jobs. Given these other responsibilities, it is difficult to see how the group has 
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the time and resources to monitor the status of medical equipment in the provincial 
hospital system. In contrast, infrastructure decisions are made by a group of seven 
staff members, primarily professional engineers, whose only focus is on maintaining 
the hospital system's infrastructure. The equipment area could benefit from having 
staff whose primary role relates to ongoing equipment issues and maintenance in the 
hospital system. 

Recommendation 4.5 

The Department of Health and Wellness should assign sufficient staff resources to 
review hospital system equipment funding requests. 

Department of Health and Wellness Response: 

DHW agrees with this recommendation and will assess the benefits of having staff members 
solely dedicated to hospital system equipment. DHW will complete the assessment by 
March 31, 2014. Any staffing changes based on this assessment will follow. 

4.29 When discussing funding requests and equipment needs, the equipment group does not 
include staff from district health authorities. Scoring criteria used to rank projects are 
not shared with the district health authorities. As a result, each district has developed 
its own approach to prioritizing equipment needs. This lack of information regarding 
how the Department scores potential projects leads to significant variations between 
how districts rank their projects and how the Department's equipment group ranks 
projects. For example, only five district health authorities had their top-ranked project 
funded for 2012-13. The remaining districts' highest ranked projects were scored 
significantly lower by the Department. Of the top-ten priority projects submitted 
from one district, the fourth- and tenth-ranked items were funded. 

4.30 The Department's failure to share its scoring criteria and approach with district 
health authorities prevents the districts from identifying needs which are consistent 
with provincial priorities for equipment funding. There may be items which should 
have been included on district priority lists which were excluded because the districts 
were not aware of the provincial direction. While the Department of Health and 
Wellness is responsible for determining system-wide priorities, such wide disparities 
between district health authority rankings and the Department's rankings should be 
addressed. 

Recommendation 4.6 

The Department of Health and Wellness should include the district health authorities 
and the IWK Health Centre in its criteria selection and scoring processes for equipment 
allocation. 

Department of Health and Wellness Response: 

DHW agrees with this recommendation and the need for representation from district 
health authorities and the IWK Health Centre in reviewing and revising criteria and 
scoring processes. DHW is currently working on expanding the Medical Capital 
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Equipment Committee to include representation from the district health authorities and 
the IWK Health Centre. The new committee will be in place by Apr 1, 2013. 

4.31 Overall scoring system - Although the current system is an improvement over previous 
years in which the Department simply allocated funding by approving the same 
number of projects in each district, further changes are still needed. As noted below, 
the Department needs to examine its scoring system to minimize inconsistencies and 
ensure it adequately considers all risk areas. 

4.32 Criteria weighting - The Department Ted committees involved in allocating funds for 
equipment and infrastructure all use a statistical system (Pairwise) to score district 
health authority submissions. Each committee or group has developed its own 
scoring criteria based on what it considers as the most significant considerations for 
equipment or infrastructure funding. Criteria are compared against each other and 
ranked as being of equal importance, lesser importance, or more important. These 
rankings mean a criterion that is considered more important will contribute more to 
the final project score. 

4.33 We identified multiple inconsistencies in how this system is applied. Criteria which 
have been determined to be of equal importance are not always scored consistently 
against the remaining criteria. This could lead to a project score which is different 
from what would be expected and undermines the objective approach the Department 
is attempting to use. 

Recommendation 4. 7 

The Department of Health and Wellness should review its use of the Pairwise scoring 
system and ensure that criteria are weighted in a consistent and appropriate manner. 

Department of Health and Wellness Response: 

DHW agrees with this recommendation and the need to review its use of the Pairwise 
scoring system. DHW committees using the Pairwise scoring system will work together to 
resolve identified issues. The system is expected to be reviewed for Sept 30, 2013. 

4.34 Project scoring - Once the criteria have been weighted, they are used to score each 
submission using a predetermined scoring approach. Both infrastructure committees 
and the equipment group have prepared tables outlining what to look for when scoring 
each project against the criteria. 

4.35 Although criteria weighting needs to be examined, we did not identify any concerns 
or inconsistencies in how the two infrastructure committees scored projects. 

4.36 We did have a number of concerns with the equipment group's scoring approach and 
its application of that approach. The following exhibit provides an overview of that 
group's criteria and scoring approach. 
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0.417 


0.083 
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0.167 



4.37 The equipment group's criteria consider risk and safety matters differently from the 
infrastructure funding committees. Rather than considering the potential for harm 
to patients or staff, the equipment group focuses on actual instances of harm to staff 
or a patient. The potential for harm does not result in a higher score under risk and 
safety. 



4.38 During our audit, we reviewed a funding request to replace equipment which the 
district health authority had removed from service due to concerns with increased 
levels of radiation exposure to staff and patients. This request only scored four of 
a possible 10 points for risk because there were no specific instances of harm to 
patients or staff. Ultimately, the equipment was not funded because it did not score 
high enough in comparison to other requests. However if scoring was based on the 
potential for harm to staff and patients, this request would have scored higher and 
would have been funded based on the ranking of other projects that year. 

4.39 For five of the 20 equipment sample items we tested, we found equipment scoring 
was not supported. Similar equipment was scored very differently with no support 
to indicate the rationale for varying scores. Department management were unable to 
explain the differences and in each case consistent scoring would have impacted the 
final funding decisions. 
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4.40 We also found an additional seven instances in which the final scoring did not appear 
consistent with the scoring matrix. In one situation, Department management assigned 
a higher risk score based on incidents of harm they said had likely occurred, although 
this was not suggested in the district health authority submission. We also identified 
situations in which equipment condition and efficiencies were not scored according to 
the established criteria. Management were unable to provide reasonable explanations 
for these differences as they do not keep any records of the rationale or discussions 
supporting final decisions. In many instances, these scoring inconsistencies impacted 
the final allocations of funding. 

4.41 While a scoring system can help to bring consistency to evaluating equipment funding 
requests, the detailed criteria must be applied in a consistent manner. Otherwise, 
what appears to be an objective, supportable system becomes a mostly subjective 
approach, particularly when there is no evidence to support final decisions. 

Recommendation 4.8 

The Department of Health and Wellness should revise the scoring approach for its 
equipment group to ensure that final scoring is consistent with funding criteria. 

Department of Health and Wellness Response: 

DHW agrees with this recommendation and the need for more consistency in the scoring 
of funding criteria. DHW will continue to review and revise the scoring approach for the 
Medical Capital Equipment Committee on an annual basis. The Committee is expected 
to review and revise the scoring approach for Sept 30, 2013. 

Recommendation 4.9 

The Department of Health and Wellness should develop a process to ensure 
information to support equipment scores assigned during capital funding is adequately 
documented. 

Department of Health and Wellness Response: 

DHW agrees with this recommendation and the need for documentation to support 
equipment scores. DHW will have processes in place to strengthen documentation of 
decisions and supporting rationale by Jan 1, 2013. 

4.42 Department funding requests - The Department asked each district health authority 
to submit its top-ten funding requests for equipment and a full list of infrastructure 
projects for 2012-13. While this is an improvement over funding requests in prior 
years in which only three equipment items were requested, it fails to consider the 
relative size and mix of services offered in each district. 

4.43 Capital Health has more than 13,000 pieces of equipment spread over eight hospitals, 
including the province's tertiary care site which has more than five buildings. Some 
of the smaller districts have only two or three hospitals while larger districts may 
have several facilities. Each district submits the same number of equipment requests, 
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regardless of how many pieces of equipment each district has in its facilities or on its 
priority lists. In order to adequately consider system-wide needs, it is reasonable to 
expect a larger number of projects should be submitted from larger districts. 

Recommendation 4.10 

The Department of Health and Wellness should examine its process for requesting 
equipment funding submissions to ensure it considers the relative size of each district 
and the mix of services offered. 

Department of Health and Wellness Response: 

DHW agrees with the recommendation and the need to consider the relative size and mix 
of services offered in each district. The population served along with impact on services 
are factors currently considered in the criteria. DHW will continue to explore options 
for the completion of a provincial plan for clinical services to guide future decisions 
regarding mix of services. DHW will continue to review and revise the process and 
criteria on an annual basis. The Committee is expected to review and revise the process 
by Sept 30, 2013. 

4.44 Consideration for efficiencies - We found the scoring approach used by both 
infrastructure groups and the equipment group did not consider the overall project 
cost savings and efficiencies. 

4.45 Future cost savings - The Department's criteria for ranking funding requests and 
their final scoring approaches do not adequately address the future cost savings 
associated with projects. While one of the scoring criteria does consider whether 
there are efficiencies which might be achieved, it does not consider the level of future 
cost savings relative to the original project cost. Identifying projects with ongoing 
operational cost savings provides an opportunity to reduce overall costs or to move 
those funds elsewhere in the system. Given the significant financial challenges facing 
the province and the hospital system, it would seem appropriate to identify projects 
with significant future savings attached and ensure this is factored into funding 
decisions. 

4.46 We identified a project with an estimated cost of $4.5 million submitted to the 
equipment committee by Capital Health for 2012-13. This project had a projected 
savings of $3 million per year. Much of the identified savings were to result from a 
decrease in full-time-equivalent staff in an area for which Capital Health had been 
experiencing significant labour shortages. This project was scored such that it was not 
approved during the initial funding allocations; the scoring did not appear consistent 
with the scoring matrix. Department management could not explain why the scoring 
was inconsistent or why a project with such a high level of future cost savings would 
not have been approved. This project was ultimately approved during our audit, after 
the initial capital equipment funding approvals. Health and Wellness management 
have not been able to provide an explanation of why this was not originally scored 
higher and approved. 
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Recommendation 4.11 

The Department of Health and Wellness should revise the approach used to score 
infrastructure and equipment needs to include specific consideration of future cost 
savings. 

Department of Health and Wellness Response: 

DHW agrees with the recommendation and the need to include consideration of future 
cost savings in the decision-making process. Efficiency, costs savings and business cases 
are currently considered in the criteria for equipment. DHW will continue to review and 
revise how best to incorporate future cost savings in the decision-making process. The 
process will be reviewed by Sept 30, 2013. 

4.47 Current funding challenges - During our audit we hoped to identify the total dollar 
value of the high priority capital needs across the province. However, we found 
that there is no information at the Department of Health and Wellness regarding 
system-wide needs. Most district health authorities recognize that funding is limited 
and only prepare detailed estimates for their priority lists to the extent they expect 
funding will be available. While some districts may have complete lists of capital 
requirements, it is not clear which items are urgent and the items further down the list 
have less detailed information on costs. 

4.48 Although province-wide capital needs were not available, we reviewed the district's 
submissions to Health and Wellness for funding approval. These include all 
infrastructure requirements and each district health authority's 10 highest-ranked 
equipment requests. 

4.49 For 2012-13, funding compared to requests was as follows. 

• Infrastructure Repair and Renewal Committee: approved $3 million of the 
$6.1 million requested 

• Infrastructure Management Repair and Renewal Committee: approved $9.5 
million of the $103 million requested 

• Equipment group: approved $11.6 million of the $37.9 million requested 

4.50 This leaves more than $120 million of repairs and replacements which district health 
authorities deemed necessary unfunded. Districts may obtain additional funding 
from their foundations, but this has averaged around 20% of total funding over the 
past five years and does not come close to bridging the gap. 

4.51 Since we were completing detailed audit work at Capital Health, the province's largest 
district health authority, we reviewed medical equipment capital asset record listings 
to determine the number of pieces of equipment and its approximate age. Capital 
Health has more than 13,000 pieces of equipment. The District depreciates equipment 
over 10 years. While this is not an exact measure, it does represent a reasonable 
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assessment of equipment condition. We found 16.2% of medical equipment (more 
than 2,100 pieces) was between 10 and 15 years old; 4.7% (633 pieces) was between 
15 and 20 years; and 5.3% (718 pieces) was over 20 years old. In total, more than 
3,500 pieces of equipment, or 26% of Capital Health's equipment, exceeded 10 years 
of age. 

4.52 Future infrastructure requirements - The Department's Infrastructure Management 
group estimated $600 million would be needed for the hospital system's basic 
infrastructure needs over the next ten years. This only includes more significant 
items such as boilers, doors, windows and roofs, along with any major renovation 
projects. It does not include many other routine items such as plumbing and other 
systems. Management told us this is a preliminary estimate. We did not audit this 
figure, but use it as a reference point for the overall state of the system and potential 
funding needs. Equipment requirements are not included in this estimate and the 
equipment group does not have any estimate of total future needs for the hospital 
system. 

4.53 $22 million was allocated for all infrastructure projects in 2012-13; only $6.4 million 
in emergency and specified funding was provided in 2011-12. Based on Health and 
Wellness' estimate, more than $60 million is likely to be needed for basic infrastructure 
on an annual basis for the next ten years. The current capital stock is not sustainable 
given the rate of funding required to maintain it. 

4.54 Facility condition index - With assistance from the districts, the department used 
facility asset management software to collect basic facility information on all hospital 
buildings in Nova Scotia. The software projects future repairs and renewals based on 
when roofs, windows and other infrastructure are likely to require replacement. 

4.55 For each facility, a facility condition index is calculated by dividing the estimated 
cost to repair a facility by the estimated cost to replace the facility. Department 
management told us that the construction industry often uses a benchmark of 30% 
as an indicator of when facility replacement should be considered. Management 
acknowledged that 30% may be slightly different for hospital facilities, especially 
given the current infrastructure challenges in the hospital system; however it can still 
provide a starting point for higher-level decisions. 

4.56 We reviewed the facility condition assessment data but did not audit it for accuracy or 
completeness. We removed smaller buildings, such as storage sites, boilers or health 
clinics that were often associated with a hospital site. This left 53 buildings around 
Nova Scotia. The results illustrate the significance of the infrastructure problems 
facing the province. 

• For 26 buildings, the cost to repair compared to replacement cost exceeded 
30%. 

• Each district had at least one building which exceeded 30%. 
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• 14 facilities exceeded 40%. 

• Four facilities exceeded 50%. 

4.57 Energy performance contracting -Energy performance contracting is an arrangement 
which offers energy efficiencies to building owners without incurring the upfront costs 
usually associated with infrastructure work. Energy services contractors perform 
energy infrastructure audits to identify potential savings. The building owner and the 
contractor then negotiate an agreement whereby the contractor will pay the upfront 
capital cost of improvements. The contractor's expenses plus a profit margin will 
be paid back using the actual energy efficiency savings experienced by the owner. 
Once this initial investment plus profit has been paid, the new infrastructure and the 
resulting cost savings accrue to the building owners, in this case the province. 

4.58 These contracts provide the expertise and financial capital to undertake significant 
energy efficiency capital upgrades without impacting capital budgets. According to 
the Federal Office of Energy Efficiency, the federal government has undertaken at 
least 85 retro-fits under these contracts, resulting in $320 million in infrastructure 
investments and over $40 million in annual savings. 

4.59 To date, the province has not authorized the use of such arrangements for hospital 
infrastructure. Health and Wellness management told us this is because district 
health authorities are not permitted to incur debt under the Health Authorities Act 
without Governor-in-Council approval. Health and Wellness management also 
believe that the Department cannot undertake these agreements because the districts 
own hospital buildings. However, the province could permit these arrangements by 
providing Governor-in-Council approval. Alternatively, the province ultimately owns 
and is responsible for hospitals in Nova Scotia and accordingly, could undertake these 
arrangements on behalf of the districts. Energy performance contracting appears to 
have been used successfully by other governments in Canada and may provide a 
mechanism to improve the hospital system's infrastructure. 

Recommendation 4.12 

The Department of Health and Wellness should examine the risks and rewards of 
energy savings contracts. The results of this analysis should be used to determine 
whether to pursue these contracts in the province's hospital system. 

Department of Health and Wellness Response: 

DHW agrees with the recommendation and the need to examine the risks and rewards of 
energy savings contracts. DHW will review and complete the analysis by Mar 31, 2013. 
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Capital Planning at the District Health Authorities 



Conclusions and summary of observations 

Capital Health prepares annual three-year capital plans, but we found neither South Shore 
Health nor Guysborough Antigonish Strait Health Authority look at capital planning 
beyond the current year. In both instances, district management identified inconsistent and 
insufficient funding from the Department as the reason for only considering the current 
year. We found both South Shore Health and Capital Health have reasonable processes in 
place for prioritizing capital projects, although we recommended both districts develop an 
objective means of ranking all district capital priorities into multi-year plans. We noted 
Guysborough Antigonish Strait Health Authority only prioritized as many projects as 
necessary for their requests to the Department, instead of maintaining a full list of high 
priority projects. 



4.60 Long-term capital plans - Capital Health's three-year business plans included capital 
plans for 2011-12 and 2012-13 fiscal years. Guysborough Antigonish Strait Health 
Authority and South Shore Health did not have multi-year capital plans. In both 
cases, District management told us that a lack of available and consistent Department 
funding made multi-year capital planning ineffective and the work involved wasteful. 
South Shore Health began a living project priority list for the 2012-13 planning 
cycle; this is a prioritized list of all necessary projects. While it does not include 
the timeline for capital expenditures, it does give management useful information 
concerning priorities. Guysborough Antigonish Strait Health Authority did not have 
a comprehensive, district-wide capital priority listing compiled during the audit 
period. 

4.61 Long-term strategic planning is an important part of any government organization. 
Multi-year capital plans for district health authorities would help district management 
focus on the infrastructure and equipment they will require to provide health services 
to the public. 

Recommendation 4.13 

Guysborough Antigonish Strait Health Authority and South Shore Health should 
prepare multi-year capital plans. 

Guysborough Antigonish Strait Health Authority Response: 

GASHA has separate planning processes for capital equipment and infrastructure repair 
& renewal. 

Capital Equipment - Outside of significant investments from DHW, GASHA relies on 
community contribution by auxiliaries and foundations for new and replacement 
equipment. GASHA agreed that money donated by a community partner would only 
be used in the facility that partner supported. Lists are produced by each hospital and 
prioritized by hospital management. Infrastructure Repair & Renewal - In the fall 
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Engineering Services requests information from each site on the equipment repairs/ 
replacements they require for the upcoming year and conducts an annual inspection of 
each hospital. A prioritized list of projects is forwarded to Senior Leadership for review, 
and the approved list is submitted to DHW for funding. 

GASHA agrees with this recommendation and will be exploring options to implement a 3 
to 5 year capital plan for the current business planning cycle. 

South Shore Health Response: 

South Shore Health agrees with recommendation. South Shore Health (SSH) will explore 
processes used by other government agencies to find one that will work for us. Multi-year 
plans are done for major physical assets such as SSH's master plan. A multi-year capital 
plan would be more useful if supported by multi-year funding projections from funding 
partners. 

4.62 Capital project prioritization process - Each of the districts we visited for detailed 
audit work had its own processes for prioritizing capital projects as part of the annual 
budget process. 

4.63 Capital Health has multiple processes for prioritizing capital expenditures. District 
management told us that for 2010-11, hospital departments identified their medical 
equipment needs and those needs were ranked by a district Capital Equipment 
Committee. Management said that due to a lack of available funding, this list was 
effectively rolled forward to the following year. 

4.64 Capital Health's Construction and Facilities group prioritized infrastructure repair 
and renewal projects using an informal consensus approach. No objective scoring 
system was used to rank these projects. Clinical capital projects were ranked by the 
district's Space and Construction Committee, using a project scoring template, with 
established criteria for 2011-12. This Committee was disbanded prior to the 2012-13 
planning cycle and the 2011-12 list was simply refreshed for 2012-13 to replace the 
limited number of projects addressed in the prior year, when only emergency funding 
was received from the Department of Health and Wellness. District management told 
us they plan to redesign the capital planning processes for 2013-14. 

4.65 Guysborough Antigonish Strait Health Authority did not have comprehensive capital 
priority lists. The District had processes to identify medical equipment project 
priorities, but district-wide project lists were developed only to the extent necessary 
to fulfill provincial funding requests. 

Recommendation 4.14 

Capital Health and Guysborough Antigonish Strait Health Authority should develop 
an objective ranking system for all capital project priorities. 

Capital Health Response: 

In May 2012, Capital Planning was consolidated under one Director, where previously it 
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was shared among three. At this time a Capital Plan Budget was submitted and approved 
for the current fiscal year. A review of the prioritization process of Capital Projects 
began in August 2012, and a working group is developing an objective process that will 
be used for Capital Equipment, Capital Infrastructure, and Capital IT Projects which will 
be followed next fiscal year 2013/2014. 

Guysborough Antigonish Strait Health Authority Response: 

The Guysborough Antigonish Strait Health Authority's capital equipment process has 
a scale from 1 to 7 that uses a single criteria rating scale. The DHW infrastructure 
repair - renewal form uses a set of criteria that is weighted to produce a consolidated 
priority score when evaluating projects. GASHA agrees with this recommendation and 
will implement similar criteria for all capital projects. 

Recommendation 4.15 

Guysborough Antigonish Strait Health Authority should prepare an objective 
district-wide capital project priorities list. 

Guysborough Antigonish Strait Health Authority Response: 

The Guysborough Antigonish Strait Health Authority agrees with this recommendation. 

4.66 South Shore Health did not prioritize capital projects for 2011-12 because the 
Department had informed districts there would be no capital funding. For 2012- 
13, capital projects were prioritized using the Department of Health and Wellness' 
repair and renewal scoring system with oversight from the District's Expenditure 
Prioritization Committee. We believe the process was a reasonable approach to 
identify capital priorities. 

4.67 Project submission justification - We assessed each district's capital project 
submissions to the Department for the three districts we visited during our audit. Both 
Capital Health's and South Shore Health's capital project priorities were reasonably 
justified and supported. Submissions followed established Department and district 
policies and procedures. 

4.68 We found Guysborough Antigonish Strait Health Authority did not always complete 
its own required forms for capital submissions to the Department of Health and 
Wellness; although we found the District did follow the Department's processes. 

Capital Asset Records and Asset Management 



Conclusions and summary of observations 

We found preventative maintenance was not conducted as it should be and is insufficient to 
maintain the capital stock at all Districts we audited. Further, we determined the condition 
of infrastructure assets at Capital Health has made requests for immediate maintenance to 
repair equipment a common occurrence; these have taken precedence over preventative 
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maintenance. Long-term, preventative maintenance practices are more cost effective than 
corrective maintenance and are important to maintaining the capital stock to operate the 
province's hospital system. 



4.69 Medical equipment asset records - The districts have various computerized and 
manual systems to track the many medical capital equipment assets and associated 
maintenance activities. None of the three districts we audited had a single consistent 
system for this purpose. The records and maintenance activities are managed by 
internal departments for some medical equipment at Guysborough Antigonish Strait 
Health Authority and South Shore, or by the Health Association of Nova Scotia. We 
understand other district health authorities also use this organization. We determined 
the asset records reasonably track age and maintenance activity, although we found 
some minor issues with completeness of this data across all three districts. 

4.70 None of the districts consistently tracked the current condition of medical equipment 
assets. All districts rely on professional judgment of staff and management to maintain 
awareness of asset condition. Accurate records including detailed assessment of 
current condition would be helpful to management when making capital planning 
decisions. 

Recommendation 4.16 

Capital Health, Guysborough Antigonish Strait Health Authority, and South Shore 
Health should track the current condition of significant medical equipment assets and 
infrastructure. 

Capital Health Response: 

All new equipment purchases are being entered in a database that includes life cycle 
and will improve the ability to track equipments condition over the period it is in service. 
The current condition of several other groups of medical equipment are being tracked 
separately, however these records are not kept for all areas. Work is ongoing to create 
a comprehensive list and full assessment of significant medical equipment assets and 
infrastructure. Management plans to continue improved tracking. 

Guysborough Antigonish Strait Health Authority Response: 

The Guysborough Antigonish Strait Health Authority agrees with this recommendation 
however a substantial provincial investment is required to implement the SAP asset 
management application. This could be a strategic plan item for Merged Service Nova 
Scotia once operational. In the interim, GASHA has discussed options and opportunities 
with Clinical Engineering Services at Health Association Nova Scotia to determine if 
expansion of their database is possible. 

South Shore Health Response: 

SSH agrees with this recommendation and is currently working with internal departments 
and our Clinical Engineering Service on a methodology that will capture the current 
condition of medical equipment and infrastructure during preventative maintenance 
activities. 
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4.71 Preventative maintenance- Preventative maintenance should be performed on medical 
equipment assets in the hospital system. The frequency is generally determined by 
the equipment manufacturers, although district staff occasionally use professional 
judgment to modify the schedule for some equipment. 

4.72 We selected a sample of 100 medical equipment assets from across the three district 
health authorities we visited to determine whether preventative maintenance was 
conducted as appropriate based on each district's schedule. We found a significant 
percentage of preventative maintenance was not carried out. While we found the 
most recent maintenance cycle had often been completed, we noted that previous 
cycles had not. Overall, the established frequencies were not met in 40% of the 
samples; the results are summarized in the following table. 



District Health Authority 


Most recent preventative 
maintenance complete? (%) 


Preventative maintenance 
conducted at appropriate 
frequency (%) 


Capital Health - 40 samples 


35 (88%) 


21 (53%) 


Guysborough Antigonish Strait 
Health Authority - 30 samples 


27 (90%) 


23 (77%) 


South Shore Health - 30 samples 


23 (77%) 


16 (53%) 


Total 


85 (85%) 


60 (60%) 



4.73 At Capital Health, the bio-medical engineering department attaches a risk rating 
to each piece of equipment requiring preventative maintenance. These ratings are 
used to prioritize the work load, with any high risk items intended to be addressed 
first. While these ratings do not exist for other Districts, or for the lab or diagnostic 
imaging groups at Capital Health, we felt this was still a reasonable assessment of the 
challenges facing preventative maintenance. 

4.74 We assessed the compliance report for February 2012 and found 74% of high risk 
equipment preventative maintenance had been completed. The overall compliance 
rate was 62%. Preventative maintenance is not carried out as often as intended. 

4.75 We believe not performing preventative maintenance as necessary and scheduled will 
ultimately lead to untimely equipment failures, potentially resulting in increased wait 
times and negative impacts to patient safety. It could also lead to increased costs 
from preventable repairs and unplanned purchases. 

4.76 Infrastructure assets - Infrastructure asset conditions are monitored and evaluated by 
facility management personnel responsible for maintenance in the districts. This has 
also included the use of external consultants to conduct facility condition assessments, 
on an as needed basis. Facility maintenance systems are in place at all districts. We 
did not test preventative maintenance activities for hospital infrastructure, instead 
focusing on the equipment within the hospitals. 

4.77 Capital Health facility management and supervisors indicated they find it difficult to 
meet the required preventative maintenance schedules for their facilities. In many 
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cases, preventative maintenance is not occurring as it should; similarly, equipment 
preventative maintenance schedules often cannot be achieved with available funding. 
Management indicated this is related to a combination of aging assets, an increase 
in corrective repairs rather than preventative maintenance, along with insufficient 
engineering staff to address the repairs. 

4.78 South Shore Health management provided evidence showing that while they are 
able to complete most of the required preventative maintenance, it occasionally 
takes longer than intended. They provided a chart showing when the scheduled 
maintenance for one month was completed. While 95% of the work was completed, 
only 66% was carried out in the month intended; a further 27% was completed the 
following month. 

4.79 Guysborough Antigonish Strait Health Authority does not have a clear record of 
preventative maintenance which was not completed on time. 

Recommendation 4.17 

Capital Health, Guysborough Antigonish Strait Health Authority and South Shore 
Health should ensure preventative maintenance activities are completed as scheduled. 

Capital Health Response: 

PM (preventative maintenance) is performed to maximize patient and staff safety while 
minimizing downtime and costs. Devices with wearable parts undergo PM so parts can 
be replaced before a defect and higher cost incurs. In some cases, field practice indicators 
support no PM cycles and when manufacturer's guidelines are being followed, no PM 
is recommended. Management will work on an improved procedure (where applicable) 
around PM cycles, documentation, and increased accountability on frontline and those 
responsible for PM. CDHA is in the process of revising the Asset Inventory and Online 
Work Order System to be more comprehensive, with a focus on PM work. 

Guysborough Antigonish Health Authority Response: 

The Guysborough Antigonish Strait Health Authority agrees with this recommendation. 
This solution would be available in the SAP asset management application but in the 
interim, GASHA will evaluate other applications/solutions that could bridge the gap. 

South Shore Health Response: 

SSH recognizes the importance of preventative maintenance. We work to complete 
all activities as scheduled, but at times, resources constraints will not permit all to be 
done within the planned time period. The district will perform a review of all current 
preventative schedules/activities and develop a prioritized preventative maintenance 
schedule thus ensuring that if there are infrequent occasions when all maintenance 
cannot be completed in a given timeframe, resources will be directed to higher priority 
maintenance activities. 

4.80 Adverse events involving equipment and infrastructure - We looked at adverse 
events at hospitals in the three districts we audited to determine whether deferred 
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maintenance, or failure to replace equipment or infrastructure, had led to specific 
harm to patients or staff. Each District maintains extensive records around adverse 
events. We did not find any evidence of specific instances in which patient or staff 
harm could be traced back to failure to complete maintenance or failure to replace or 
repair equipment or infrastructure. 
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Department of Health and Wellness: Additional Comments 



The Department appreciates the thorough review by the Auditor General on Capital 
Planning and recognizes the importance of reviewing and revising the process in 
order to make continuous improvements in capital planning. We agree with all of the 
recommendations and implementation of many of the suggested improvements have 
already commenced. Although many areas for improvement have been identified, 
there have been tremendous advances in Capital Planning during the past three years. 



Capital District Health Authority: Additional Comments 



#78 - CH facility management and supervisors note that preventive maintenance 
is not always completed as scheduled/required -this is due to: not being aware 
of new equipment in use, information not being centrally recorded (such as 
PM requirements), equipment and/or infrastructure being outdated, or having 
resources available to do the PM work (vs resources being dedicated to repairs). 
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Summary 



Overall, the Market Projections Report prepared by Trade Centre Limited in 2010 to 
support government investment in the new convention centre lacks the appropriate analysis 
and rigor expected for such a significant proposal. We expected a much more comprehensive 
analysis supporting such aggressive growth targets. Important industry realities have not 
been clearly addressed. We recommended that the Executive Council Office obtain an 
independent second opinion on the market projections for the new convention centre. 

We also found financial and operational activities examined during our audit were not 
appropriately managed. Trade Centre Limited does not have an adequate internal control 
framework or sufficiently rigorous financial management practices. This contributed to a 
number of the control deficiencies we found. We identified control weaknesses and instances 
of noncompliance related to the management of entity revenues and expenses. 

The documentation supporting the rationale for the allocation of costs between Trade 
Centre Limited and the Halifax Metro Centre is insufficient and we found errors in the 
allocations. Pricing guidelines have not been provided to sales staff to ensure corporate 
objectives are being achieved and event results are not adequately monitored. 

Trade Centre Limited does not have adequate processes for the approval of travel and 
business expenses. The CEO's expenses were not reviewed and approved, and a number 
of paid claims were not supported by appropriate documentation. Trade Centre Limited's 
business travel and expense policy is not consistent with the government travel policy. 

Trade Centre Limited does not have adequate processes to ensure the procurement 
of goods and services complies with applicable policies and provides value for money. We 
identified purchases in which Trade Centre Limited and government procurement policies 
were not followed. The Trade Centre Limited procurement policy has insufficient provisions 
for situations in which alternative procurement procedures are necessary. 

We found regular financial and operational reporting to the Board is adequate. 
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Background 



5.1 Trade Centre Limited is a provincial crown corporation which is accountable to 
the Minister of Economic and Rural Development and Tourism. Its mission is to 
create economic and community benefits by bringing people together in Halifax and 
Nova Scotia. The President and Chief Executive Officer (CEO) is responsible for the 
operations of Trade Centre Limited and is accountable to a twelve-member Board of 
Directors. 

5.2 Trade Centre Limited consists of six business units. Those units are described below 
along with their financial results for 2007-08 to 2010-11 before depreciation and 
taking into consideration government funding. In addition, Trade Centre Limited 
has an agreement with the Halifax Regional Municipality to operate and manage the 
Halifax Metro Centre. 

5.3 The World Trade and Convention Centre has approximately 50,000 square feet of 
convention and meeting space in downtown Halifax. It hosts between 550 and 
600 events annually. Revenues are earned mainly from room rentals and food and 
beverage purchases. 



World Trade and Convention Centre 


2007-08 


2008-09 


2009-10 


2010-11 


Net profitability 


($2,325,932) 


($1 ,324,633) 


($1 ,639,882) 


$4,017,322 


Less: Halifax Regional Municipality 
funding 

Provincial funding 


554,099 


570,168 
99,000 


570,758 
49,000 


571,899 
(1) 4,849,000 


Total government funding 


554,099 


669,168 


619,758 


5,420,899 


Net profitability without government 
funding 


($2,880,031) 


($1,993,801) 


($2,259,640) 


($1,403,577) 



(1) This figure includes a one-time operating grant of $4.8 million. 

(2) These figures are unaudited. They were provided by Trade Centre Limited. 



5.4 Exhibition Park is a 102,557 square foot, four-building complex outside downtown 
Halifax used for trade shows, public shows, dinners, weddings, exhibitions, and other 
types of events. 
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Exhibition Park 


2007-08 


2008-09 


2009-10 


2010-11 


Net profitability 


($664,638) 


($551,550) 


($533,887) 


($368,022) 


Total government funding 










Net profitability without government 
funding 


($664,638) 


($551,550) 


($533,887) 


($368,022) 



(1) These figures are unaudited. They were provided by Trade Centre Limited. 



5.5 The World Trade and Convention Centre Office Tower is rented out to tenants, 
primarily provincial government entities. 



World Trade and Convention Centre 
Office Tower 


2007-08 


2008-09 


2009-10 


2010-11 


Net profitability 


$1,143,981 


$923,869 


$1,307,769 


$1,355,352 


Total government funding 










Net profitability without government 
funding 


$1,143,981 


$923,869 


$1,307,769 


$1,355,352 



(1) These figures are unaudited. They were provided by Trade Centre Limited. 



5.6 Ticket Atlantic provides ticket purchasing services for events at the Halifax Metro 
Centre and other venues. It sells tickets for up to 400 events annually; Trade Centre 
Limited earns a service charge for each ticket sold. 



Ticket Atlantic 


2007-08 


2008-09 


2009-10 


2010-11 


Net profitability 


$348,118 


$881,228 


$257,786 


($81 ,006) 


Total government funding 










Net profitability without government 
funding 


$348,118 


$881,228 


$257,786 


($81 ,006) 



(1) These figures are unaudited. They were provided by Trade Centre Limited. 



5.7 The World Trade Centre Atlantic Canada is an international trade organization to 
create new connections and business opportunities for Atlantic Canadian businesses 
looking to be more globally competitive. 



World Trade Centre Atlantic Canada 


2007-08 


2008-09 


2009-10 


2010-11 


Net profitability 


($409,738) 


($371,646) 


($16,324) 


($216,062) 


Total government funding 










Net profitability without government 
funding 


($409,738) 


($371,646) 


($16,324) 


($216,062) 



(1) These figures are unaudited. They were provided by Trade Centre Limited. 
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5.8 Trade Centre Limited Major Events works in collaboration with other Trade Centre 
Limited business units, strategic partners in the community, and governments to 
attract new major events for the province (for example Brier, Canada Winter Games, 
international hockey). 



Trade Centre Limited Major Events 


2007-08 


2008-09 


2009-10 


2010-11 


Net profitability 


($328,108) 


$182,052 


($20,170) 


($183,252) 


Less: Provincial funding 
Federal funding 


110,000 




300,000 
241,117 


300,000 
242,882 


Total government funding 


110,000 




541,117 


542,882 


Net profitability without government 
funding 


($438,108) 


$182,052 


($561 ,287) 


($726,134) 



(1) These figures are unaudited. They were provided by Trade Centre Limited. 

(2) Effective fiscal 2009-10, provincial and federal funding relates to the Events Nova Scotia program which 
Trade Centre Limited manages on behalf of the government partners. 



5.9 The following is a financial summary of operations for Trade Centre Limited, before 
depreciation, taking into consideration amounts which were not allocated among 
business units noted above and the impact of government funding. 



Total for Trade Centre Limited 


2007-08 


2008-09 


2009-10 


2010-11 


Net profitability 


($2,150,479) 


($110,210) 


($622,559) 


$4,669,252 


Less: HRM funding 

Provincial funding 
Federal funding 


554,099 
110,000 


570,168 
99,000 


570,758 
349,000 
241,117 


571,899 
< 1 > 5,149,000 
242,882 


Total government funding 


664,099 


669,168 


1,160,875 


5,963,781 


Net profitability without government 
funding 


($2,814,578) 


($779,378) 


($1 ,783,434) 


($1 ,294,529) 



(1) This figure includes a one-time operating grant of $4.8 million. 

(2) These figures are unaudited. They were provided by Trade Centre Limited. 



5.10 After taking into consideration government funding, Trade Centre Limited has 
incurred an operating loss for the past four years. In 2011-12, Trade Centre Limited 
budgeted an operating deficit of $268,700 before depreciation; its actual result was an 
operating deficit of $32,335 before depreciation. 

5.11 As noted in the 2011-12 business plan, Trade Centre Limited's goal is to approach a 
breakeven position before depreciation. Government provided Trade Centre Limited 
with a directive requiring they breakeven before depreciation for the 2012-13 fiscal 
year. 

5.12 Trade Centre Limited has 100 salaried staff; it also employs hourly staff as required 
based on levels of activity. 
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5.13 For March 31, 2011, Trade Centre Limited reported holding 793 events with 623,898 
attendees and $72.2 million in direct expenditures. The accuracy of these numbers 
is discussed later in this chapter. Trade Centre Limited management indicated these 
events generated economic spinoffs of $46 million in incremental expenditures and 
$4.2 million in provincial tax revenue. These figures include Halifax Metro Centre 
statistics as well. Ticket Atlantic reported 492 sale events and the average occupancy 
of the Office Tower was 100%. For March 31, 2011, Trade Centre Limited reported 
$18,722,156 in revenues and $15,699,734 in expenses. 

5.14 Trade Centre Limited is also an advisor to government on the new convention centre 
in Halifax. The province has committed $56 million, the federal government $51 
million, and Halifax Regional Municipality $56 million toward the convention centre 
portion of a planned $500 million project by Rank Inc. to build a financial centre, 
hotel complex, and retail and public space in downtown Halifax. Trade Centre 
Limited prepared market projections for the new convention centre. Trade Centre 
Limited projected the new facility would host 6,800 events, 2.2 million visitors and 
inject $750 million of direct expenditures into the local economy during its first 10 
years of operation. 



Audit Objectives and Scope 



5.15 In the fall of 2012, we completed a performance audit of Trade Centre Limited. The 
audit was conducted in accordance with Sections 18 and 21 of the Auditor General 
Act and auditing standards established by the Canadian Institute of Chartered 
Accountants. 

5.16 The purpose of this audit was to determine if there are processes and procedures to 
adequately manage Trade Centre Limited. 

5.17 The objectives of this audit were: 

• to review and assess certain aspects of financial and operational management 
of Trade Centre Limited including financial and operational reporting and 
monitoring, controls over revenues and expenses, and travel and other staff 
related expenses; 

• to assess whether Trade Centre Limited has adequate processes to monitor and 
assess the performance of senior management and staff; 

• to assess whether Trade Centre Limited has processes to ensure the procurement 
of goods and services complies with applicable policies and provides for value 
for money; and 

• to review and assess the process and assumptions used to develop the market 
projections for the new convention centre. 
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5.18 Generally accepted criteria consistent with the objectives of the audit did not exist. 
Audit criteria were developed specifically for this engagement using both internal and 
external sources. Criteria were accepted as appropriate by Trade Centre Limited's 
senior management. 

5.19 Our audit approach included interviews with Trade Centre Limited staff, management 
and Board members; review of systems and processes and testing certain processes 
and key controls; and examination of policies, minutes and any other documentation 
deemed necessary. Our audit period included activities conducted primarily between 
April 1, 2010 and September 30, 2011. 



Significant Audit Observations 



Financial and Operational Reporting to the Board 



Conclusions and summary of observations 

Trade Centre Limited's financial and operational monitoring and reporting to the Board is 
adequate. The reporting covers all the significant goals, operations and responsibilities of 
the Board. The information is timely and there is opportunity for discussion and challenge 
by Directors. We did find one error in the 2010-11 Annual Report which understated the 
number of events held during the year. 



5.20 Reporting - The Board meets regularly, approximately every two months. Financial 
results are reviewed and discussed. Information provided includes comparisons of 
financial budgets to actual and forecasted results as well as a comparison to the prior 
year. Quarterly updates on the business plan are also provided. The CEO makes a 
regular presentation at each Board meeting providing an update on matters of interest 
to the Board. The Annual Report is also an important source of information for 
the Board. It provides a summary of key activities during the year, including the 
estimated economic impact of Trade Centre Limited events. Board members have 
the opportunity to discuss and challenge the information presented. 

5.21 We selected a sample of information reported to the Board and found the information 
was generally accurate. We did find one figure which was incorrect. The 2010 -11 
Annual Report indicates there were 793 events held during the year. There were 
actually 804 events held, a difference of 11 events. Staff indicated that a sector of 
events was missed; in this case the economic impact of that sector was not significant. 
There should be sufficient controls in place to ensure the information reported in the 
Annual Report is accurate. 

Recommendation 5.1 

Trade Centre Limited should implement a process to review and approve the accuracy 
of information reported in the Annual Report. 
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Trade Centre Limited Response: 

Recommendation Complete: TCL already has a comprehensive process in place to 
review and approve information in the TCL Annual Report, which includes verification 
of information presented in the Annual Report to all source documents and review and 
approval of the report by the CEO, CFO, Director of Marketing and Communications, 
TCL Board Chair, Minister and TCL's external auditors. In 2011, a comprehensive 
process associated with data collection for economic impact reporting was put in place 
by management in order to ensure that the Fiscal 2011-12 economic information was 
accurate. 

The one incorrect event figure identified by the OAG was due to an error in data collection 
associated with the source document for economic impact reporting. The error resulted 
in an immaterial understatement of number of events (11 of 804 events; 1.4%) which does 
not impact a reader's assessment of the information presented in this area or the Annual 
Report as a whole. TCL is unaware of any other inaccuracies in the information reported 
in the 2010-11 Annual Report. 

Revenues and Expenses 



Conclusions and summary of observations 

Trade Centre Limited does not have an adequate internal control framework which has 
contributed to a number of the control deficiencies noted in this report. We found a 
number of weaknesses and instances in which controls did not operate as intended. The 
documentation supporting the rationale for the allocation of costs between Trade Centre 
Limited and Halifax Metro Centre is insufficient. We also noted errors in the actual costs 
allocated. Pricing guidelines have not been provided to sales staff to ensure corporate 
objectives are being achieved and event results are not adequately monitored. We also 
noted a number of instances in which there was a lack of appropriate documentation; 
this was a common issue identified throughout the audit. We recommended that Trade 
Centre Limited conduct a comprehensive assessment of its internal control framework and 
implement changes as required. 



5.22 Controls over revenues and expenses - We reviewed processes and controls in place 
for Trade Centre Limited major revenue streams including event revenues, Ticket 
Atlantic service charge revenues and lease revenues. We examined a sample of 
expenses related to various business units. The findings detailed in the following two 
paragraphs resulted from our examination of 45 expense transactions and 31 revenue 
transactions. In addition, we examined a sample of revenues and expenses directly 
related to Halifax Metro Centre but only to assess whether they were recorded in the 
correct entity. This is discussed later in this chapter. 
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5.23 As a result of our detailed testing we identified a number of control weaknesses 
including the following. 

• Limited guidance or other documentation is available respecting which financial 
and operational controls are to be implemented and how those controls should 
be implemented. 

• There is no process to ensure key controls are working as intended. 

• There is a lack of an appropriate segregation of duties related to certain accounts 
receivable and payable functions. 

• Monthly accounts receivable reconciliations are not reviewed and approved by 
management. 

• No reconciliations were completed of the advanced ticket sales general ledger 
account to the system which records ticket sales. 

• There is no evidence that managers review event orders and banquet checks for 
completeness and accuracy. 

• There is no evidence that the mathematical accuracy of consumption reports is 
being reviewed. 

• Promoter rebates were not verified prior to payment. 

• The documentation supporting the ticket service charge amount is not 
adequate. 

• There is no evidence that the accuracy of service charges entered into the 
computer system was reviewed and approved. 

• There is no evidence that the allocation of operating costs charged to tenants 
was reviewed. 

• Blank cheques are not appropriately safeguarded. 

• There was no review and approval of the reconciliation of vendor statements to 
the accounts payable records. 

• The documented signing authorities for purchases, payments and contracts 
need to be reviewed and updated to ensure they are complete and accurate. 

5.24 Our detailed testing of a sample of transactions also identified instances in which 
control procedures failed to operate as intended. 

• One bank reconciliation was not reviewed and approved. 

• A client was overbilled as a result of a mathematical error on a consumption 
report. 

• Six event orders were not signed by the client as required. 



Report of the Auditor General ••• November 2012 



Trade Centre Limited 



• Two journal entries were not approved as required. 

• 15 invoices were not approved for payment as required. 

• Five purchase orders were issued after the goods or services were obtained. 

• Two items were purchased without the required purchase order. 

• There was no verification of credit card transaction fees which were 
electronically withdrawn from the bank. 

• We identified ten invoices which lacked appropriate supporting documentation. 
In one instance, the invoice was $1,489 greater than the purchase order and 
there was no evidence the discrepancy was investigated. 

5.25 The number and significance of the weaknesses and deficiencies identified during our 
testing demonstrate that Trade Centre Limited does not have an adequate internal 
control framework in place. We found a number of control weaknesses. Trade Centre 
Limited needs to conduct a comprehensive assessment of its internal control systems. 
This assessment should consider the basic requirements of an internal control 
framework including the identification and analysis of risks, controls necessary to 
mitigate identified risks, and the processes required to monitor whether controls are 
operating as intended. This assessment and implementation of required changes 
should be a priority for Trade Centre Limited. 

Recommendation 5.2 

Trade Centre Limited should conduct a comprehensive assessment of its internal 
control systems including the identification and analysis of financial and operational 
risks, controls necessary to mitigate residual risks and the design of an effective 
monitoring process. 

Trade Centre Limited Response: 

TCL believes that the financial and operational controls and processes that TCL has 
in place including compensatory controls have been adequate to provide reasonable 
assurance that reliable financial information is produced and that operations are 
managed effectively, however, TCL will undertake an assessment of its internal control 
systems. 

Recommendation 5.3 

Trade Centre Limited should document the internal control framework resulting from 
the assessment of its internal control systems. The framework should be implemented 
and monitored for compliance. 

Trade Centre Limited Response: 

TCL believes that the financial and operational controls and processes that TCL has 
in place including compensatory controls have been adequate to provide reasonable 
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assurance that reliable financial information is produced and that operations are 
managed effectively. Of the control weaknesses identified by the OAG, TCL comments 
that many of these relate to lack of documented evidence such as sign off as it relates to 
review or approval of certain processes, although it would be management 's position that 
appropriate review did take place. TCL is not in agreement with the OAG 's assessment 
of control weaknesses associated with accuracy of promoter rebates and reconciliation 
of advanced ticket sales. 

TCL will document and implement a sustainable internal control framework and 
monitoring process based on any significant findings associated with the proposed 
internal control system assessment discussed in OAG Recommendation 5.2. 

5.26 Expense allocations - Common expenses are allocated within Trade Centre Limited 
between the various business units in order to better assess their performance. Trade 
Centre Limited also allocates common costs to Halifax Metro Centre (owned by the 
Halifax Regional Municipality) as required by the management contract. For the 
fiscal year ended March 31, 2011, expenses allocated between Trade Centre Limited 
owned business units totaled $5.3 million or 38% of total expenses. 

5.27 A significant common cost shared between Trade Centre Limited and Halifax Metro 
Centre relates to Trade Centre Limited salaried employees. In the 2011-12 budget, 
salaries totalling $3.3 million for 48 Trade Centre Limited staff were allocated 
between the two entities. Of this amount, $1.7 million was allocated to Trade Centre 
Limited and $1.6 million to Halifax Metro Centre. It is important that these costs are 
allocated accurately; otherwise one entity may pay for costs it has not incurred which 
would impact the bottom line of both entities. 

5.28 There is no documented support for the appropriateness of the expense allocation 
between Trade Centre Limited and Halifax Metro Centre and the percentages used 
internally to allocate shareable costs among business units. For example, management 
told us that the cost for natural gas is allocated 50% to each of Trade Centre Limited 
and Halifax Metro Centre based on usage estimated by management. There was no 
support for how the usage was estimated. We were also informed that the salary 
allocations between Trade Centre Limited and Halifax Metro Centre are based on 
estimates of the percentage of each individual's work with each entity. Management 
indicated this estimate was determined in consultation with applicable senior 
management. However, there is no documentation from senior managers supporting 
what the percentages should be. As a result, we could not conclude on whether the 
allocation of costs was accurate and based on an adequate analysis. 

Recommendation 5.4 

Trade Centre Limited should have an adequate analysis to support the allocation of 
expenses between Trade Centre Limited and Halifax Metro Centre, as well as internally 
among Trade Centre Limited business units. This analysis should be documented. 
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Trade Centre Limited Response: 

It is TCL's opinion that a reasonable approach to allocation of shared services and 
expenditures has been applied on a consistent basis to its internal business areas and 
Halifax Metro Centre. 

In conjunction with ongoing work with the Halifax Regional Municipality (HRM) to 
finalize a new operating agreement for the Halifax Metro Centre, TCL will document 
and formalize an approach to allocations for shared services and expenditures between 
TCL and Halifax Metro Centre which will result in an approved TCL allocation policy 
and protocol. 

5.29 The salary allocations between Trade Centre Limited and Halifax Metro Centre 
are established each year through the budget process. We compared the allocation 
percentages of the 48 staff approved in the 2011-12 budget to the actual percentage 
allocations recorded in the general ledger. We identified 16 staff whose approved 
budget allocation percentage was different from the actual percentage used from April 
to October 2011. Management told us they did not change the percentages to those 
approved in the budget because of an anticipated restructuring within Trade Centre 
Limited. Following the restructuring, the salary allocations were updated. However, 
there was no entry to correct the April to October allocations for 16 staff. There were 
also two staff whose salary allocations did not change during the restructuring; those 
salaries were improperly allocated for the entire year. This error resulted in Trade 
Centre Limited under billing salary costs to Halifax Metro Centre by approximately 
$43,000. 

Recommendation 5.5 

Trade Centre Limited should ensure actual salary allocations agree with the approved 
allocations in the budget effective April 1 each year. 

Trade Centre Limited Response: 

Recommendation Complete: This recommendation has already been implemented after 
the audit period. 

Effective April 1, 2012 ensuring salary allocations based on the approved budget are 
incorporated in the payroll system is part of the TCL budget process. 

5.30 When salary allocations are changed, the controller completes a change form which 
lists the employee, the existing allocation, and the new percentage. The form does 
not provide an explanation for the change and does not require further approval. The 
original salary allocations are approved by the Board through the budget process. If 
any changes are required, the reason should be documented and the change form 
should be approved by the Chief Financial Officer. 
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Recommendation 5.6 

Trade Centre Limited should clearly document the rationale for changes to Halifax 
Metro Centre salary allocations. The changes should be approved by the Chief 
Financial Officer. 

Trade Centre Limited Response: 

Recommendation Complete: This recommendation has already been implemented after 
the audit period. 

While changes to Halifax Metro Centre salary allocations from approved budget are kept 
to a minimum, effective fiscal 2012-13, the agreed change process now requires that the 
CFO sign off on any changes noting the reason for the change. 

5.31 Management of operations - During our audit we identified a number of improvements 
which could be made in the way Trade Centre Limited operations are managed. 
These are discussed further in the paragraphs below. Addressing these areas for 
improvement will help ensure corporate objectives are met. 

5.32 Discounts on event revenue - Discounts are provided for events held at the World 
Trade and Convention Centre and Exhibition Park. The discount amount is at the 
discretion of the sales managers; it can cover items such as free or reduced rent and 
ancillary services. There are no guidelines provided to sales managers to ensure 
corporate objectives are met when pricing events. Such guidelines would document 
Trade Centre Limited's expectations of sales staff when pricing various sizes and 
types of events. 

Recommendation 5.7 

Trade Centre Limited should establish event pricing guidelines for sales staff. 
Trade Centre Limited: 

TCL has guidelines around event pricing for WTCC and Exhibition Park including 
standard rate cards for both room rental and food and beverage menu pricing that are 
used by sales staff as they negotiate event contracts. Any discounts from standard rates 
are clearly documented in the approved event contract. 

TCL will formalize its general practice around event pricing to develop a policy and 
protocol establishing pricing strategies for various types and sizes of events. 

5.33 Event profit/loss analysis - We found Trade Centre Limited's finance department is 
not completing a profit/loss analysis of events held at World Trade and Convention 
Centre and Exhibition Park on a regular basis. During our audit period (18 months), 
they completed an analysis of only six events. There were 804 events during 2010- 
11. Staff told us the events were selected randomly to understand the profitability 
for different types of events, and which types of business generate the most net 
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contribution towards fixed overhead. We believe all significant events should be 
assessed so that corrective actions can be taken in a timely manner. 

Recommendation 5.8 

Trade Centre Limited should complete a profit/loss analysis for significant events and 
take action as appropriate. 

Trade Centre Limited Response: 

TCL routinely reviews key ratios on all of its event operations to ensure appropriate levels 
of financial contribution as part of its financial review processes. The hosting of multiple 
simultaneous events in the facility adds significant complexity to identifying specific costs 
and completing an accurate profit /loss analysis on an individual event basis. 

TCL will review current industry practices and processes around individual event profit/ 
loss analysis for convention centres of other like-size facilities and address the OAG 
recommendation based on its review of these industry practices. 

5.34 Ticket Atlantic base service charge - Ticket Atlantic levies a base service charge on 
each ticket they process. There is no documented analysis to demonstrate this is the 
optimum service charge. Staff indicated the rate was determined based on a blend of 
cost recovery, as well as what the market will bear. Due to the lack of documentation, 
we concluded that the service charge amount is not supported. 

Recommendation 5.9 

Trade Centre Limited should analyze and document the rationale for the Ticket Atlantic 
base service charge. 

Trade Centre Limited Response: 

Recommendation Complete: This recommendation has already been implemented after 
the audit period. 

The rationale for the current Ticket Atlantic base service charge is documented and the 
rationale for any future change will be fully supported and documented. 

5.35 Halifax Metro Centre commission - Ticket Atlantic pays a $0.40 per ticket commission 
for events held at Halifax Metro Centre. There is no formal contract confirming 
this arrangement and no documented analysis to support the amount. Management 
indicated this has been the general practice since Ticket Atlantic was created. 

Recommendation 5.10 

Trade Centre Limited should formalize, with the Halifax Regional Municipality, the 
Ticket Atlantic per ticket commission to be paid to the Halifax Metro Centre. 

Trade Centre Limited Response: 

In conjunction with HRM's review of Halifax Metro Centre operations, TCL has agreed to 
work with HRM to formalize the Halifax Metro Centre ticket commission arrangement. 
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5.36 Promoter advances - Trade Centre Limited has a new policy concerning advances 
paid to promoters. It is designed to limit the risk of loss to Trade Centre Limited. 
The policy states that the promoter must agree in writing to assume all risks for funds 
disbursed and repay the funds in full if the event does not proceed. The request 
must be signed by two Trade Centre Limited staff. We tested two events in which 
an advance was made after the new policy came into effect. In one instance, the 
promoter did not agree to assume the risk for the funds disbursed. Neither advance 
had two signatures by Trade Centre Limited employees as required. In both cases, 
the amounts involved were not significant. 

Recommendation 5.11 

Trade Centre Limited should follow its policy on advances to promoters. 
Trade Centre Limited Response: 

Recommendation Complete: This recommendation has already been implemented. 

The existing policy on advances to event organizers is routinely followed and monitored 
for compliance by TCL. The two advances identified by the OAG were permitted by the 
policy under the criteria of nominal operational advances and were not significant in 
terms of the amount of the advance ($2,000 and $5,000). The deviations identified by 
the OAG were around documentation associated with these nominal operating advances 
which occurred during the transition to the new policy. These deviations were addressed 
by TCL at the time, with further education of staff on the new policy. To date, there have 
been no further deviations. 

5.37 Allocation of common costs to tenants - Certain of the operating costs for the Office 
Tower are allocated to tenants as part of their lease agreements. The calculation 
is based on each tenant's share of the total rentable square footage of the Office 
Tower. Trade Centre Limited has an internal occupancy report which notes the total 
rentable square footage of the Office Tower is 127,148 square feet. Most of the leases 
define the total rentable square footage as 116,190. There is one lease which does not 
adequately clarify the total rentable square footage to be used. Therefore, we could 
not determine the correct allocation of operating costs for that lease. Another lease 
defined the total rentable square footage but there was an error in the allocation which 
resulted in the tenant overpaying approximately $800 for 2010-11. 

Recommendation 5.12 

Trade Centre Limited should allocate operating costs to tenants based on the lease 
terms. All new leases should define total rentable square footage. 

Trade Centre Limited Response: 

TCL has allocated operating costs to tenants consistently based on a formula used since 
the building opening. TCL will ensure all new office tower leases include a definition of 
total rentable square footage. 
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Performance Management 



Conclusions and summary of observations 

During our audit period, Trade Centre Limited did not have adequate processes in place 
to monitor and assess the performance of senior management and staff other than the 
CEO beginning in 2011-12. Performance expectations were not clearly documented and 
performance evaluations were not completed on a regular basis. 



5.38 Monitoring CEO performance - To help ensure the CEO is effective in fulfilling his 
roles and responsibilities, it is important that the Board evaluate his performance 
annually. Performance expectations should be defined at the beginning of the year 
and include specific measurable targets. The CEO's contract was effective September 
29, 2009. There were no documented performance expectations against which he was 
to be evaluated until March 2011. We were informed there was a delay in evaluating 
the CEO because the Board wanted to develop an appropriate evaluation tool. The 
CEO received an appropriate evaluation for the 2011 calendar year. 

5.39 Monitoring other senior management and staff performance - We selected a sample 
of five staff members to determine if they had documented performance expectations 
and annual performance evaluations. For 2010-11, we found that none of the five 
individuals had documented performance expectations; for 2011-12, there were no 
documented expectations for three of the five. 

5.40 We also found that performance evaluations were not completed on a regular basis. 

• Of the five individuals selected, only one had an evaluation completed for 2010- 
11. 

• Of the remaining four individuals: 

• one was hired in 2008 and did not receive a formal evaluation until January 
2012; 

• one was evaluated in 2008 and not again until January 2012; 

• one individual was evaluated in 2007 and then in January 2012; and 

• one individual was evaluated in 2010 but not again as of February 2012. 

5.41 Performance evaluations are necessary to ensure that staff are meeting desired 
performance expectations consistent with corporate objectives. Regular evaluations 
should be conducted for all staff. Performance evaluations were completed for senior 
management for calendar 201 1. These evaluations could be improved by including an 
assessment against measurable performance goals and targets. 
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Recommendation 5.13 

Trade Centre Limited should conduct regular performance assessments on senior 
management and staff which include measurable performance targets and goals. 

Trade Centre Limited Response: 

Recommendation Complete: This recommendation has already been implemented after 
the audit period. 

TCL introduced a performance appraisal policy, approved by the Board of Directors in 
March 2012, and is in compliance with this policy, which addresses the recommendation 
of the OAG. TCL's Board of Directors also developed, approved and implemented a new 
CEO evaluation model effective March 2011. 

Travel Expenses and Other Staff- Related Expenses 



Conclusions and summary of observations 

Trade Centre Limited does not have adequate processes to appropriately approve travel 
and business expenses. During our audit period, the CEO's travel and business expenses 
were not reviewed and approved. We tested a sample of staff and senior management 
travel claims and identified a number of claims which lacked appropriate documentation 
supporting the amounts paid. We also found Trade Centre Limited's business travel and 
expense policy is not consistent with the government travel policy as required. 



5.42 Travel policies - Trade Centre Limited is required to comply with the government 
travel policy. Trade Centre Limited has been following its draft business travel and 
expense policy dated June 2008. The policy has not been reviewed and updated since 
2008 and has not been approved by the Board. We assessed the policy for consistency 
with the government travel policy and found the following inconsistencies. 

• The policy allows a $10 incidental per diem for each day of travel compared to 
the government policy which allows $5/day if there is an overnight stay. 

• Since 2008, the policy had included a mileage rate of $0.405/km. The provincial 
mileage rate changes periodically. Between April 2010 and March 2011, the 
provincial rate was $0.3813/km. Effective April 2011, it changed to $0.4015/ 
km. 

• The policy does not include a per diem meal allowance; however management 
has allowed a per diem of $55/ day to be claimed. The government policy per 
diem is $38/ day. 

• The policy does not require an out-of-country travel form to be completed. 
Government policy requires such a form. 
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5.43 The CEO's internal practice is to pre-approve all business travel and expenses and 
approve all travel expense claims. This is not currently reflected in Trade Centre 
Limited's policy. The policy should be consistent with current practice. 

5.44 The Trade Centre Limited business travel and expense policy only requires that the 
number of persons being entertained be documented on the travel claim. Noting the 
names of the persons entertained and the reasons for the entertainment on the travel 
claim would improve disclosure. 

Recommendation 5.14 

Trade Centre Limited should update its business travel and expense policy to be 
consistent with the government travel policy as required. The policy should also be 
updated to include appropriate documentation requirements and approvals. 

Trade Centre Limited Response: 

Recommendation Complete: This recommendation has already been implemented after 
the audit period. 

TCL has reviewed and updated its business travel and expense policy and protocols to be 
consistent with government policy. 

Recommendation 5.15 

Trade Centre Limited's updated business and travel expense policy should be approved 
by its Board and implemented. 

Trade Centre Limited Response: 

TCL has implemented its updated business and expense policy effective October 2012. TCL 
Board of Directors will review and approve the policy at its next meeting in November 
2012. 

5.45 Staff business travel and expense testing - We tested a sample of 30 Trade Centre 
Limited staff travel expense claims for compliance with both the government travel 
policy and Trade Centre Limited policy. We found the following instances of 
noncompliance. 

5.46 When using a personal credit card, the Trade Centre Limited's policy requires an 
itemized receipt or an invoice supplied by the establishment indicating payment 
of the account. This is consistent with the government travel policy. An itemized 
receipt would provide sufficient support for what was actually purchased to assess 
reasonableness and appropriateness. We found 23 of 30 travel claims tested included 
expenses which did not have an itemized receipt submitted. These claims related to 
97 individual expenses totaling $7,282. 

5.47 For entertainment or hospitality expenses, the Trade Centre Limited policy requires 
that the claim note the purpose and the number of persons attending. Adequate 
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disclosure would identify those who were entertained, rather than just the number 
of people. Of the 23 travel claims tested which included entertainment costs, 16 
had expenses which did not indicate the names or number of individuals entertained. 
This related to 21 individual expenses totaling $2,901. Additionally, the purpose 
of the entertainment was not noted for 13 claims related to 24 individual expenses 
totaling $1,849. 

5.48 The Trade Centre Limited Policy requires employees to sign an authorization form for 
use of their own vehicle on company business to ensure adequate insurance has been 
obtained. This requirement is not being followed. 

5.49 The Trade Centre Limited Policy requires travel be approved at least 30 days in 
advance to help ensure the use of early booking discounts. Of the 28 expense claims 
tested which included travel costs, 18 were not pre-approved. Of the 10 claims which 
were pre-approved, seven were not approved at least 30 days prior to travel. 

5.50 CEO business travel and expense testing - We tested 11 of the CEO's 2010-11 
travel expense claims and found the following instances of noncompliance with the 
government and Trade Centre Limited policies. Itemized receipts were not submitted 
for all 11 claims related to 98 individual expenses totaling $6,237. As well, all 11 
claims had expenses with no indication of the names or number of individuals 
entertained. This related to 51 individual expenses totaling $2,613. Additionally, all 
claims had expenses which did not indicate the purpose of the entertainment; this 
related to 78 individual expenses totaling $3,436. 

Recommendation 5.16 

Trade Centre Limited should comply with its business travel and expense policy and 
develop a process to monitor compliance. 

Trade Centre Limited Response: 

Recommendation Complete: This recommendation has already been implemented after 
the audit period. 

TCL has implemented its updated business travel and expense policy effective October 
2012, which includes the process and protocol for monitoring. 

5.51 CEO travel claim approval - During our audit period, the CEO's travel expenses 
were not reviewed and approved. Best practice would suggest that the Board Chair 
would be the most appropriate person to review, assess the reasonableness of, and 
approve the CEO's claims. 

Recommendation 5.17 

Trade Centre Limited CEO travel expense claims should be reviewed and approved by 
the Board Chair. 
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Trade Centre Limited Response: 

Recommendation Complete: This recommendation has already been implemented after 
the audit period. 

CEO expenses were reviewed consistently under the TCL process used with respect to 
all staff related travel and other expenses. Effective November 2011, TCL updated its 
process for CEO expense claim review to incorporate the approval of all CEO claims by 
the Board Chair or designate. 

Procurement 



Conclusions and summary of observations 

Trade Centre Limited does not have adequate processes to ensure the procurement of 
goods and services complies with applicable policies, including ensuring value for money 
is achieved. During our testing, we identified purchases for which the Trade Centre 
Limited procurement policy and government procurement policy were not followed. The 
Trade Centre Limited procurement policy has insufficient provisions for situations when 
alternative procurement procedures are required. 



5.52 Procurement policies and other requirements - Trade Centre Limited is required to 
apply the principles and objectives of public procurement as described in the Province 
of Nova Scotia Sustainable Procurement Policy. These include the requirement for 
open, fair, and transparent procurements which maximize competition and value. We 
reviewed Trade Centre Limited's procurement policy to determine if it is consistent 
with the government procurement policy. We found Trade Centre Limited's policy 
has no detailed provisions for situations when alternative procurement procedures 
are required. 

5.53 Through discussions with Government Procurement Services staff, we also 
determined that Trade Centre Limited is required to complete an alternative 
procurement form when the Trade Centre Limited policy requirements for tenders 
and quotes are not followed. This form supports why tendering and quotes were not 
obtained and includes approval for deviating from the policy. If the transaction is 
in excess of $10,000, Government Procurement Services must be consulted before 
proceeding with an alternative procurement transaction. These requirements are not 
included in the Trade Centre Limited procurement policy. Without clear guidelines 
to address situations in which alternative procurement methods may be used (e.g., 
purchasing without a competition) and the process to follow, there is a risk that 
alternative procurement methods will be used inappropriately. 

5.54 Testing - We tested 30 procurement transactions and found the following. 

• There were eight procurements in excess of $10,000, for which tendering was 
not carried out and an alternative procurement form was not completed. In 
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all cases, Trade Centre Limited management indicated the purchase was an 
alternative procurement in which tendering was not required. 

• There were four procurements between $1,000 and $10,000 for which quotes 
were not obtained and an alternative procurement form was not completed. 
Trade Centre Limited management indicated that two of these procurements 
should have had quotes obtained while the other two were alternative 
procurements for which quotes were not required. 

Recommendation 5.18 

Trade Centre Limited should update its procurement policy to include requirements for 
the use of alternative procurement practices. 

Trade Centre Limited Response: 

Recommendation Complete: This recommendation has already been implemented after 
the audit period. 

TCL updated its procurement policy effective October 2012 to include the use of 
appropriate alternative procurement documentation including the use of the Alternative 
Procurement Form. 

Recommendation 5.19 

Trade Centre Limited should comply with its procurement policy and develop a process 
to monitor compliance. 

Trade Centre Limited Response: 

Recommendation Complete: This recommendation has already been implemented after 
the audit period. 

TCL has revised its procurement process to require periodic internal review of the 
organization's procurement activities by TCL Finance to ensure activities are in 
compliance with TCL's procurement policy and protocols. 

Market Projections for New Convention Centre 



Conclusions and summary of observations 

Overall, the market projections report (2010) prepared by Trade Centre Limited staff 
lacks appropriate analysis and rigor expected for such an assignment. Significant growth 
projected in certain market segments was not adequately supported. Important industry 
realities such as an excess supply of convention centre space, new competitors, and a 
stagnant convention centre market have not been adequately considered and assessed. We 
expected a much more comprehensive analysis supporting such aggressive growth targets 
than what was performed. We recommended that the Executive Council Office obtain an 
independent second opinion on the market projections for the new convention centre. 
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5.55 Background - In June 2010, Trade Centre Limited staff prepared a report titled 
Market Projections for a Proposed New Convention Centre - 10 Year by Market 
Segment. This report included a projection of the direct expenditures made by 
convention centre visitors over a 10-year period. These expenditures were used to 
determine the economic impact of the ongoing operations of the convention centre in 
the business case submitted to Executive Council. The projected number of visitors 
and their expenditures while in Nova Scotia are important inputs in determining 
the potential economic impact of the operations of a new convention centre. If the 
number of visitors expected and resulting direct expenditures are inaccurate, the 
expected economic impact will likely be inaccurate as well. 

5.56 It is important to note that our audit examined only the process and analysis used by 
Trade Centre Limited in the preparation of the market projection report. We have 
not audited any other aspects of the funding or analysis by government for the new 
convention centre project. We have not assessed, nor do we provide an opinion on, 
the merits of a new convention centre. 

5.57 The market projections report is broken down into six market segments. These 
segments include international, national association, national corporate, provincial 
and regional, local, and consumer and trade shows. Our audit work focused on the 
international, national association, and national corporate segments as they represent 
a significant portion of the projected direct expenditures in the report. 

5.58 Market projections are future orientated and can be complex in nature. They are 
typically calculated through a combination of three methods: expert forecasts based 
on reliable industry data or market research; estimates based on past data; and 
educated assumptions. The rigor that we expected to see supporting the projections 
in the three market segments reviewed was not evident. Aggressive growth targets 
and key market share assumptions have not been adequately supported. 

5.59 Projected growth rates - The Trade Centre Limited report projects significant 
growth in all three of the major industry segments we examined. The following table 
summarizes the projected growth included in the Trade Centre Limited report for 
these segments. The table illustrates the projected increase in the number of events, 
attendees and direct expenditures. 





INTERNATIONAL 


NATIONAL ASSOCIATION 


NATIONAL CORPORATE 




Base Year 


Year 1 


% 
Growth 


Base Year 


Year 10 


% 
Growth 


Base Year 


Year 10 


% 
Growth 


Number of 
Events 


7 


29 


314% 


14 


41 


193% 


10 


30 


200% 


Number of 
Attendees 


3100 


13450 


334% 


7800 


22750 


192% 


2565 


15900 


519% 


Direct 

Expenditures 


$3,227,100 


$14,001,450 


334% 


$12,714,000 


$37,082,500 


192% 


$4,180,950 


$25,917,000 


519% 
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5.60 While we acknowledge it is a reasonable assumption that a larger, more versatile 
convention centre would enable Trade Centre Limited management to attract bigger 
events in greater numbers, we do not believe that Trade Centre Limited has adequate 
support for the aggressive growth numbers in the table above. The following 
paragraphs provide the detail supporting our conclusion. 

5.61 International market - The total 10-year projected direct expenditures in the Trade 
Centre Limited report for the international market segment are approximately 
$95 million. Trade Centre Limited management uses two key assumptions when 
calculating the projected number of events in this segment. They assume that the 
growth in the international market in Canada will continue at a similar rate to 
the growth experienced between 1999 and 2008, as reported by the International 
Congress and Convention Association in their Statistics Report - The International 
Association Meetings Market - Abstract for non-members - 1999 - 2008. They also 
assume that Halifax's share of the Canadian market in year 10 will be 6.5%, which 
they believe is similar to Ottawa's and Quebec City's share of the market, as included 
in the referenced report. 

5.62 There are several important factors which could impact on Trade Centre Limited 
achieving its projected results which have not been adequately addressed. Although 
Halifax has qualities which make it attractive to the international market, it will 
need to compete with facilities both in Canada, the United States and abroad. Given 
that the convention industry in North America appears to be stagnant, it is not clear 
how Trade Centre Limited will attract business away from key competitors. As an 
example, the current international market in Canada is dominated by large cities like 
Montreal, Toronto and Vancouver (based on a report prepared by consultants HLT 
Advisory titled Ontario Convention Market Analysis in February 2008.) In a stagnant 
or declining market Halifax would need to attract business away from other cities as 
the number of available events does not seem to be growing. Other important factors 
impacting this market segment include the increased value of the Canadian dollar 
and the excess supply of available convention space. Trade Centre Limited has not 
developed a clear strategy that addresses these industry realities. Significant growth 
projections should be supported by a more complete and rigorous analysis. 

5.63 National association market - The total 10-year projected direct expenditures in 
the Trade Centre Limited report for the national association market segment are 
approximately $298 million. The Trade Centre Limited report projects to host 
41 events in year 10 for this segment. 41 events equates to approximately 20% of 
200 associations with an eastern region rotation. Trade Centre Limited sees the 
eastern region as including five major competitors - Montreal, Ottawa, Quebec City, 
Halifax, and the rest of Atlantic Canada. In calculating the 20% market share, Trade 
Centre Limited management assumed that each competitor would receive an equal 
percentage, or one-fifth, of the market. This represents 300% growth from the base 
2008 year. This is an overly simplistic approach and likely quite optimistic. It fails 
to take into account increased competition from facilities like universities and hotels 
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who are becoming bigger players in the industry, not only in Halifax, but throughout 
the country Questions such as how and whether the new facility can compete on 
price have not been addressed. This approach also assumes that Halifax will compete 
equally with cities like Montreal, Ottawa and Quebec City This is a risky assumption 
without a detailed assessment of potential competitors and other factors influencing 
destination decisions. 

5.64 National corporate market - The total 10-year projected direct expenditures in 
the Trade Centre Limited report for the national corporate market segment are 
approximately $194 million. Trade Centre Limited management projects that they 
will host 30 events in year 10. Unlike the other two market segments we examined, 
there is no clear rationale for how 30 events was determined. Trade Centre Limited 
provided a report on business lost to other markets which includes national corporate 
events. They also provided a consultant's report which suggests that Halifax would 
be an attractive destination for this market segment. Similar to the other market 
segments, important factors like increased competition from several expanded and 
new facilities, and other players in the market, have not been clearly addressed. 
The professional judgment of Trade Centre Limited management appears to be the 
primary source of information supporting the projections in this market segment. We 
expected a more comprehensive analysis in this area than was conducted by Trade 
Centre Limited. 

5.65 Annual growth rates - In each of the industry segments we examined, Trade Centre 
Limited management focused their analysis on the number of events they believed 
they could attract in year 10 of operations. Assumptions were made related to growth 
from years one through nine to arrive at the year 10 total. The 10-year projected direct 
expenditures are the accumulated total expenditures based on the total number of 
events and attendees over the 10-year period. Although the method of allocation over 
the nine years does not impact the number of year 10 events, it could have a significant 
impact on the 10-year total events (326) and direct expenditures of $298.5 million for 
the national association market. As an example, the number of events for this market 
is projected to increase from 13 in year one to 30 in year three (131% growth), with 
much less growth from 30 to 41 events over the next seven years (37% growth). If 
the projected growth was assumed to happen evenly over the 10-year period, it would 
reduce the 10-year total direct expenditures by approximately $55 million and the 
total number of events by 60. There has been no clear analysis supporting why this 
particular market will achieve such significant early growth. 

5.66 Sensitivity analysis - To demonstrate the sensitivity of changes to the projections 
included in the Trade Centre Limited report, we prepared the table below. We 
recalculated the impact on the total direct expenditures based on a reduction of 10% 
to 50% of the projected number of events in all market segments. As demonstrated 
by this analysis, a relatively small change in the projected number of events can have 
a significant impact on the total direct expenditures by visitors and the expected 
economic benefit of a new convention centre. 
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Trade Centre Limited 



Market 
Segment 


Original 
Projected 
Expenditures 


1 0% less 


20% less 


30% less 


40% less 


50% less 


International 


$95,199,450 


$85,679,505 


$76,159,560 


$66,639,615 


$57,119,670 


$47,599,725 


National 
association 


298,453,000 


268,607,700 


238,762,400 


208,917,100 


179,071,800 


149,226,500 


National 
corporate 


194,255,250 


174,829,724 


155,404,200 


135,978,674 


116,553,150 


97,127,625 


Provincial/ 
regional 


114,574,885 


103,117,397 


91,659,908 


80,202,420 


68,744,931 


57,287,443 


Local 


22,110,505 


19,899,455 


17,688,404 


15,477,354 


13,266,303 


1 1 ,055,252 


Consumer 
and trade 
shows 


29,411,820 


26,470,638 


23,529,456 


20,588,274 


17,647,092 


14,705,910 


Total 


$754,004,910 


$678,604,419 


$603,203,928 


$527,803,437 


$452,402,946 


$377,002,455 


Decrease 
in projected 
expenditures 




$75,400,491 


$150,800,982 


$226,201,473 


$301 ,601 ,964 


$377,002,455 



5.67 As indicated in the background section to this chapter, Trade Centre Limited 
management prepared the market projections supporting the business case for 
the new convention centre. The province has committed $56 million, the federal 
government $51 million, and Halifax Regional Municipality $56 million, towards 
this project. These commitments represent a significant investment by taxpayers. 
We have not seen appropriate evidence supporting the aggressive growth targets 
projected by Trade Centre Limited. We believe it would be prudent for the Executive 
Council Office to acquire an independent second opinion of the market potential for 
a new convention centre so that government is assured of having the best information 
available for planning purposes. 

Recommendation 5.20 

The Executive Council Office should obtain an independent second opinion on the 10- 
year market projections for the new convention centre. 

Executive Council Office Response: 

The Province is satisfied with the level of detail provided in the market projections and 
is confident in the process followed by TCL to prepare the assessment. The market 
projections for the new convention centre were only one piece of information considered 
in the investment decision to proceed with the project. Taken in their entirety, the market 
projections, various consultants' reports and assessments used to evaluate this project 
clearly highlight the need for the new convention centre and Nova Scotia's ability to 
compete effectively nationally and internationally. It is expected that as the project 
proceeds, further work will be carried out by TCL and the Department of Economic and 
Rural Development and Tourism to ensure the market projections are measured and 
achieved. 
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Trade Centre Limited: Additional Comments 



Trade Centre Limited's (TCL) Board of Directors and management are pleased by 
the Office of the Auditor General (OAG) findings that the financial and operational 
monitoring and reporting to the Board is adequate and that the reporting covers 
all significant goals, operations and responsibilities of the Board. 

TCL's Board and management are committed to continuous improvement and 
responsible business practices with a focus on developing and implementing 
measures and processes that are appropriate and sustainable for the 
organization. While we believe that the organization is effectively managed and 
governed, we recognize that improvement is required in areas and have already 
acted to implement twelve of the OAG's recommendations. TCL will address 
all of the recommendations related to the audit of processes and procedures 
associated with the financial and operational management of the organization. 

TCL maintains that the market projections for the new convention centre are 
valid and reasonable. These projections were compiled using a combination of 
primary and secondary market research, industry data, client input, estimates 
derived from past performance and educated assumptions from industry experts 
and based on TCL's industry knowledge and experience. We are confident that 
the information we have provided is reasonable and we fully expect to be held 
accountable to achieving our market projections and delivering the resulting 
business and impacts for Nova Scotia. 
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